75247 matches found
GHSA-X6FG-52VR-HJ4W Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...
GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...
GHSA-WP3C-266W-4QFQ js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
Summary js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit. Each iteration performs a BigInt BigInt operation on an accumulator that grows linearl...
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
Summary js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit. Each iteration performs a BigInt BigInt operation on an accumulator that grows linearl...
Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
Summary CVE-2026-47067 is an atom table exhaustion vulnerability CWE-770 in hackney's URL parser src/hackneyurl.erl. hackneyurl:parseurl/1 converts every URL scheme it encounters into a BEAM atom via binarytoatom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limi...
GHSA-9653-RCFR-5C62 Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
Summary CVE-2026-47067 is an atom table exhaustion vulnerability CWE-770 in hackney's URL parser src/hackneyurl.erl. hackneyurl:parseurl/1 converts every URL scheme it encounters into a BEAM atom via binarytoatom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limi...
GHSA-Q8JG-FGJ4-FPHF Hackney has unbounded buffer accumulation in WebSocket
Summary The WebSocket client in src/hackneyws.erl imposes no upper bound on memory consumption across three distinct code paths. In each case, an attacker-controlled WebSocket server can exhaust the connecting process's memory without any authentication or special client configuration. Details 1...
Hackney has unbounded buffer accumulation in WebSocket
Summary The WebSocket client in src/hackneyws.erl imposes no upper bound on memory consumption across three distinct code paths. In each case, an attacker-controlled WebSocket server can exhaust the connecting process's memory without any authentication or special client configuration. Details 1...
Hackney has CRLF / header injection in WebSocket upgrade request
Summary CRLF injection in hackney's WebSocket upgrade request builder src/hackneyws.erl. init/1 copies the host, path, headers, and protocols options from the caller-supplied opts map verbatim into wsdata, and dohandshake/1 splices them directly into the raw HTTP/1.1 upgrade request by binary...
GHSA-F9VR-G2G2-X9FG Hackney has CRLF / header injection in WebSocket upgrade request
Summary CRLF injection in hackney's WebSocket upgrade request builder src/hackneyws.erl. init/1 copies the host, path, headers, and protocols options from the caller-supplied opts map verbatim into wsdata, and dohandshake/1 splices them directly into the raw HTTP/1.1 upgrade request by binary...
GHSA-JQ4M-Q6P2-8GWC Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
Summary hackneyh3:awaitresponseloop/6 in src/hackneyh3.erl accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer, not a wall-clock deadline: every received streamdata chunk, housekeeping select message, or settings frame...
Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
Summary hackneyh3:awaitresponseloop/6 in src/hackneyh3.erl accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer, not a wall-clock deadline: every received streamdata chunk, housekeeping select message, or settings frame...
Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
Summary hackneyurl:normalize/2 URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's uristring:parse/1 and inet:parseaddress/1, neither of which decodes percent-escapes in hostnames. A URL like http://%31%32%37%2E%30%2E%30%2E%31/...
GHSA-PJ7V-XFVX-WMJQ Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
Summary hackneyurl:normalize/2 URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's uristring:parse/1 and inet:parseaddress/1, neither of which decodes percent-escapes in hostnames. A URL like http://%31%32%37%2E%30%2E%30%2E%31/...
GHSA-MP55-P8C9-RFW2 Hackney has CRLF / header injection via unvalidated `domain` and `path` options
Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...
Hackney has CRLF / header injection via unvalidated `domain` and `path` options
Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...
GHSA-F5GC-QXF8-MH9G php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Summary pontedilana/php-weasyprint builds the shell command for WeasyPrint by passing the binary path through escapeshellarg first and then checking the quoted result with isexecutable. On POSIX escapeshellarg'/usr/local/bin/weasyprint' returns '/usr/local/bin/weasyprint' with the single-quote...
