iperf: Denial of Service in iperf Due to Improper JSON Handling

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup...

iperf: Denial of Service in iperf Due to Improper JSON Handling

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup...

PT-2024-40916 · Unknown · Alloy-Json-Abi

Name of the Vulnerable Software and Affected Versions: alloy-json-abi versions prior to the version containing commit 4790c47 Description: The issue arises from improper handling of malformatted JSON ABI strings by the alloy-json-abi crate. Specifically, the JsonAbi::parse method can be exploited...

golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON

A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. Thi...

CVE-2024-3029

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

PT-2024-40314

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified netresearch/jsonmapper affected versions not specified Description The issue allows an attacker to crash PocketMine-MP by sending malformed JSON in the LoginPacket. This is due to the lack of...

PT-2026-88989

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.11.1 Description A denial of service issue exists in the processing of JSON data within the LoginPacket. Remote attackers can crash the server by sending malformed JSON data. The flaw stems from the...

PT-2023-33049 · Unknown · Netresearch/Jsonmapper +1

Name of the Vulnerable Software and Affected Versions: PocketMine-MP versions prior to 4.20.5 PocketMine-MP versions prior to 4.21.1 Description: An attacker could crash PocketMine-MP by sending malformed JSON in the LoginPacket. This issue occurred due to a bug in the netresearch/jsonmapper...

UBUNTU-CVE-2023-28096

OpenSIPS, a Session Initiation Protocol SIP server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function parsemirequest while performing coverage-guided fuzzing. This issue can be reproduced by sending...

CVE-2023-1370 Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays a...

CVE-2023-1370 Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays a...

SUSE CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

GHSA-95Q3-PPPP-R683 Crash when decoding malformed HTTP requests or malformed JSON payload

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a...

CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

Denial Of Service (DoS)

mercurius is vulnerable to denial of service. an attacker can crash the application by sending a malformed JSON to /graphql using a custom error handler...

CVE-2021-43801

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

Code injection

Mercurius is a GraphQL adapter for Fastify. Any users from email protected to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

CVE-2021-43801

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to "/graphql" unless they are using a custom error handler. The vulnerability has been fixed in...

CVE-2021-43801: Improper Check for Unusual or Exceptional Conditions

Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. The vulnerability has been fixed in...

PT-2021-23943

Name of the Vulnerable Software and Affected Versions: Mercurius versions 8.10.0 through 8.11.1 Description: The issue affects Mercurius, a GraphQL adapter for Fastify, where users can be subjected to a denial of service attack by sending a malformed JSON to the /graphql API endpoint, unless they...