19 matches found
CVE-2026-116585
A flaw was found in go-jose. Insufficient input validation during the decryption of untrusted JSON Web Encryption JWE ciphertext allows an empty buffer to be indexed during CBC-HMAC unpadding. A remote attacker can exploit this flaw by providing crafted ciphertext, triggering an application panic...
CVE-2026-100349
A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service DoS by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to...
EUVD-2026-89206
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened...
DEBIAN-CVE-2026-102823
Russh is a Rust SSH client and server library. Prior to 0.63.1, clientreadauthenticated in russh/src/client/encrypted.rs forwards CHANNELDATA, CHANNELEXTENDEDDATA, CHANNELEOF, CHANNELCLOSE, CHANNELOPENFAILURE, CHANNELSUCCESS, CHANNELFAILURE, and CHANNELREQUEST subtypes exit-status, exit-signal, a...
CVE-2026-102823
Russh is a Rust SSH client and server library. Prior to 0.63.1, clientreadauthenticated in russh/src/client/encrypted.rs forwards CHANNELDATA, CHANNELEXTENDEDDATA, CHANNELEOF, CHANNELCLOSE, CHANNELOPENFAILURE, CHANNELSUCCESS, CHANNELFAILURE, and CHANNELREQUEST subtypes exit-status, exit-signal, a...
EUVD-2021-1171
Malware in sbrugna...
GHSA-QX2Q-88MX-VHG7 Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder
Description When using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index e.g., test.18446744073704, the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts t...
RUSTSEC-2023-0039 Out-of-bounds array access leads to panic
Affected versions of the crate have a bug where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not...
Design/Logic Flaw
It is possible to crash panic an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses this issue...
CVE-2022-36125
CVE-2022-36125 affects Rust applications using the Apache Avro Rust SDK prior to 0.14.0 (formerly avro-rs). The root cause is an integer overflow when reading corrupted .avro files, leading to a crash/panic. Remediation: upgrade to apache-avro version 0.14.0, which addresses the issue. The vulner...
GHSA-QQC5-RGCC-CJQH Information Disclosure in go.elastic.co/apm
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
Information Disclosure in go.elastic.co/apm
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
Insertion of Sensitive Information into Log File
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
CVE-2021-22133
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
Design/Logic Flaw
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
CVE-2021-22133
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
CVE-2021-22133
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
CVE-2021-22133: Insertion of Sensitive Information into Log File
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...
PT-2021-14861
Name of the Vulnerable Software and Affected Versions Elastic APM agent for Go versions prior to 1.11.0 Description The issue arises when the application panics, potentially leading to the leakage of sensitive HTTP header information. Normally, the APM agent sanitizes sensitive HTTP header detail...