📄 PEGA Infinity Brute Force / Insecure Direct Object Reference

PEGA Infinity suffers from brute forcing and insecure direct object reference vulnerabilities. Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by the brute force issue. Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by the idor issue. SEC Consult Vulnerability Lab...

CVE-2026-32614

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614

CVE-2026-32614 concerns the Go ShangMi (GMSM) library’s SM9 decryption, where the ciphertext can be forged if the point C1 is the point at infinity. The root cause is that during decryption, C1 is deserialized and checked for curve membership, but the code does not reject the point at infinity, a...

CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability

Go ShangMi Commercial Cryptography Library GMSM is a cryptographic library that covers the Chinese commercial cryptographic public algorithms SM2/SM3/SM4/SM9/ZUC. Prior to 0.41.1, the current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause...

GO-2026-4694 SM9 Infinity-Point Ciphertext Forgery Vulnerability in github.com/emmansun/gmsm

SM9 Infinity-Point Ciphertext Forgery Vulnerability in github.com/emmansun/gmsm...

EUVD-2026-12101

SM9 Infinity-Point Ciphertext Forgery Vulnerability...

SM9 Infinity-Point Ciphertext Forgery Vulnerability

Overview The current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause is that, during decryption, the elliptic-curve point C1 in the ciphertext is only deserialized and checked to be on the curve, but the implementation does not explicitly...

GHSA-5XXP-2VRJ-X855 SM9 Infinity-Point Ciphertext Forgery Vulnerability

Overview The current SM9 decryption implementation contains an infinity-point ciphertext forgery vulnerability. The root cause is that, during decryption, the elliptic-curve point C1 in the ciphertext is only deserialized and checked to be on the curve, but the implementation does not explicitly...

PT-2026-25376

Name of the Vulnerable Software and Affected Versions Go ShangMi Commercial Cryptography Library GMSM versions prior to 0.41.1 Description The Go ShangMi Commercial Cryptography Library GMSM contains a cryptographic vulnerability in the SM9 decryption implementation. The issue stems from a failur...

CVE-2023-31455

Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort...

CVE-2023-31289

Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort...

CVE-2018-10432

Pexip Infinity before 18 allows Remote Denial of Service TLS handshakes in RTMP...

CVE-2018-10585

Pexip Infinity before 18 allows remote Denial of Service XML parsing...

CVE-2021-33499

Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation issue 2 of 2...

CVE-2021-31925

Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative web interface...

CVE-2022-26654

Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP...

CVE-2022-26655

Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams...