golang: encoding/xml: stack exhaustion in Unmarshal

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...

Oracle Linux 8 : container-tools:3.0 (ELSA-2022-7529)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7529 advisory. - fixes CVE-2021-3602 - amend CVE-2022-1708 - fix CVE-2022-1708 - thanks to Peter Hunt - fix CVE-2022-27650 - fixes CVE-2021-3602 - rc95 fixes...

MessagePack for Golang subject to DoS via Unmarshal panic

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1...

Denial Of Service (DoS)

github.com/shamaton/msgpack is vulnerable to denial of serviceDoS attacks. A remote attacker is able to cause an application crash in Unmarshal functionality, via a maliciously crafted input...

CVE-2022-41719

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

Denial of service

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

CVE-2022-41719

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

CVE-2022-41719 Panic in github.com/shamaton/msgpack/v2

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

CVE-2022-41719 Panic in github.com/shamaton/msgpack/v2

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

CVE-2022-41719 Panic in github.com/shamaton/msgpack/v2

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

CVE-2022-41719

CVE-2022-41719 affects github.com/shamaton/msgpack/v2, where Unmarshal can panic on certain inputs, causing DoS by crashing the application. Public references describe a DoS risk in the MessagePack for Go library; the issue has been patched in version 2.1.1.

CVE-2022-41719: Undefined Security Weakness

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

PT-2022-26046 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.1.1 Description: The issue allows for denial of service attacks due to the Unmarshal function panicking on certain inputs. Recommendations: For versions prior to 2.1.1, update to version 2.1.1 to resolve the issu...

golang: encoding/xml: stack exhaustion in Unmarshal

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...

golang: encoding/xml: stack exhaustion in Unmarshal

A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested field that uses the "any" field tag, can cause a panic due to stack exhaustion...

xstream:XmlFuzzer: Security exception in com.thoughtworks.xstream.converters.collections.PropertiesConverter.unmarshal

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=6445311384223744 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Important: golang-googlecode-net

Issue Overview: 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling,...

Amazon Linux 2 : golang-github-godbus-dbus (ALAS-2022-1858)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1858 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2288)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements if...

CVE-2022-36078 Slice Memory Allocation with Excessive Size Value in binary

Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with arbitrary excessive size value, which can either exhaust available memory or crash the whole program. When using...