17 matches found
CLEANSTART-2026-KO65183 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content
Security vulnerability affects the victoria-metrics package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...
CLEANSTART-2026-AY85890 discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary
Security vulnerability affects the victoria-metrics package. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
CLEANSTART-2026-DY81609 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the victoria-metrics package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed...
CLEANSTART-2026-LO86416 net/url package does not set a limit on the number of query parameters in a query
Security vulnerability affects the victoria-metrics package. The net/url package does not set a limit on the number of query parameters in a query...
CLEANSTART-2026-RL07145 During the TLS 1
Security vulnerability affects the victoria-metrics package. During the TLS 1...
CLEANSTART-2026-NF46642 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the victoria-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-TQ95555 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened
Security vulnerability affects the victoria-metrics package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...
CLEANSTART-2026-SR22439 Downloading and building modules with malicious version strings can cause local code execution
Security vulnerability affects the victoria-metrics package. Downloading and building modules with malicious version strings can cause local code execution...
CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-KY85414 (*x509
Security vulnerability affects the victoria-metrics package. x509...
CVE-2025-65942
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics...
CVE-2025-65942 VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the snappy:Decoder function. An attacker can cause excessive memory consumption and potential out-of-memory errors by sending malformed blocks that bypass request size limits. This...
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
Impact Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest...
PT-2025-48095
Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions 1.0.0 through 1.110.22 VictoriaMetrics versions 1.111.0 through 1.122.7 VictoriaMetrics versions 1.123.0 through 1.129.0 Description The software is susceptible to Denial of Service DoS attacks. The snappy decoder did...
VictoriaMetrics 安全漏洞
VictoriaMetrics is a time series database open-sourced by VictoriaMetrics. A security vulnerability exists in VictoriaMetrics versions 1.0.0 through 1.110.23 prior, 1.111.0 through 1.122.8 prior, and 1.123.0 through 1.129.1 prior, which stems from a request size limit being ignored by the snappy...
