FlashMQ 安全漏洞

FlashMQ is a fast and lightweight MQTT proxy server by Wiebe Cazemier. A security vulnerability exists in FlashMQ version 1.14.0, which stems from an assertion failure in the PublishCopyFactory::getNewPublish function, triggered when the QoS value of the publish object is greater than zero...

CVE-2024-42645

An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service DoS...

CVE-2024-42644

FlashMQ version 1.14.0 is susceptible to an assertion failure within the PublishCopyFactory::getNewPublish function. This vulnerability is triggered when the Quality of Service (QoS) value of a publish object is greater than 0 . The issue is categorized as a reachable assertion (CWE-617) and can ...

CVE-2024-42645: Reachable Assertion

An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service DoS...

PT-2025-31214 · Flashmq · Flashmq

Name of the Vulnerable Software and Affected Versions: FlashMQ version 1.14.0 Description: An issue in FlashMQ version 1.14.0 allows attackers to cause an assertion failure by sending a crafted retain message, leading to a Denial of Service DoS. Recommendations: At the moment, there is no...

CVE-2024-42644

FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0...

CVE-2025-38358

CVE-2025-38358 relates to a race in Linux kernel’s btrfs async reclaim path. The bug occurs when an ordered iput is delayed while BTRFS_FS_STATE_NO_DELAYED_IPUT is already set, triggering an assertion in btrfs_add_delayed_iput during close_ctree. The described scenario: async reclaim schedules wr...

CVE-2025-38358

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between async reclaim worker and closectree Syzbot reported an assertion failure due to an attempt to add a delayed iput after we have set BTRFSFSSTATENODELAYEDIPUT in the fsinfo state: WARNING: CPU: 0 PID: 65 at...

CVE-2025-38358: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between async reclaim worker and closectree Syzbot reported an assertion failure due to an attempt to add a delayed iput after we have set BTRFSFSSTATENODELAYEDIPUT in the fsinfo state: WARNING: CPU: 0 PID: 65 at...

K000152700: BIND vulnerability CVE-2025-40775

Security Advisory Description When an incoming DNS protocol message includes a Transaction Signature TSIG, BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20...

curl: Use after free (or assert triggered) with failed allocations in openssl

Summary: summary of the vulnerability A heap use after free or assertion can be triggered if some allocations fail I am not sure you consider allocations failures to be part of security issues, and I am not sure the issue lies in curl or in openssl, but I still think you want something to be fixe...

PT-2025-34401

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.16.0-rc6-syzkaller-00002-g155a3c003e55 Description: The Linux kernel contained a flaw in the netfilter bpf Berkeley Packet Filter functionality. Specifically, the nf hook run bpf function did not disable...

Apache HTTP Server Denial of Service Vulnerability (CNVD-2025-16603)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A denial of service vulnerability exists in Apache HTTP Server, which stems from a modproxyhttp2 assertion failure that can be...

CLSA-2025-1752749664 libreswan: Fix of CVE-2024-3652

CVE-2024-3652: fix assertion failure and crash caused by requesting AES-GMAC without specifying esp= line...

[slackware-security] bind

New bind packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/bind-9.18.38-i586-1slack15.0.txz: Upgraded. Fix a possible assertion failure when using the 'stale-answer-client-timeout 0' option. For...

CVE-2025-40777

If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 the only allowable value other than disabled, and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or...

CVE-2025-40777

If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 the only allowable value other than disabled, and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or...

DEBIAN-CVE-2025-40777

If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 the only allowable value other than disabled, and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or...

CVE-2025-40777

Summary: CVE-2025-40777 affects ISC BIND 9 where a named caching resolver configured with serve-stale-enable=yes and stale-answer-client-timeout=0 can abort due to an assertion failure while resolving a CNAME chain. Affected versions include BIND 9.20.0–9.20.10, 9.21.0–9.21.9, and 9.20.9-S1–9.20....

CVE-2025-40777

If a "named" caching resolver is configured with "serve-stale-enable" "yes", and with "stale-answer-client-timeout" set to "0" the only allowable value other than "disabled", and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of...