RHEL 5 : kernel (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kernel: netfilter: use-after-free in tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c CVE-2017-180...

RHEL 6 : wireshark (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c CVE-2018-6836 - The...

GO-2024-2826 Denial of service attack by triggering unbounded memory usage in vitess.io/vitess

When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service...

GO-2024-2819 Denial of Service in github.com/ethereum/go-ethereum

A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. This can result in a denial of service as the node runs out of memory...

Vitess vulnerable to infinite memory consumption and vtgate crash

Summary When executing the following simple query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. Details When running the following query, the evalengine will try evaluate it and runs forever. select utf16 0xFF The source of the bug lies in the...

CVE-2024-32886

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7...

CVE-2024-32886 Vitess vulnerable to infinite memory consumption and vtgate crash

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7...

CVE-2024-32886

CVE-2024-32886 affects Vitess vtgate, causing a Denial of Service via unbounded memory growth due to a bug in the collation/UTF-16 decoding path (affecting encodings like utf16/utf32/ucs2). Affected versions are fixed in Vitess releases 19.0.4, 18.0.5, and 17.0.7. The issue is demonstrated by a q...

CVE-2024-32886 Vitess vulnerable to infinite memory consumption and vtgate crash

Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7...

AZL-66105 CVE-2024-1930 affecting package dnf5 for versions less than 5.0.14-3

No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...

CVE-2024-1930

The CVE-2024-1930 issue affects dnf5daemon-server and is triggered by an unlimited number of sessions created via the D-Bus open_session() method. Each session spawns a thread, consuming memory (hundreds of MB per session), which can exhaust resources and render the service unable to accept new c...

Resource Exhaustion

go-ethereum geth is vulnerable to a Resource Exhaustion. The vulnerability is due to a lack of proper handling of specially crafted p2p messages sent from an attacker node, causing vulnerable nodes to consume excessive amounts of memory...

CVE-2024-32663

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19...

CVE-2024-32972

CVE-2024-32972 affects go-ethereum (geth). A vulnerable node can be forced to consume excessive memory by processing specially crafted p2p messages, triggering a denial of service. The underlying issue is related to handling certain p2p requests (notably a GetBlockHeadersRequest with crafted valu...

CVE-2024-32972 go-ethereum denial of service via malicious p2p message

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15...

GHSA-4XC9-8HMQ-J652 go-ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message...

Resource Exhaustion

Overview Affected versions of this package are vulnerable to Resource Exhaustion when handling specially crafted p2p messages. A vulnerable node can be made to consume very large amounts of memory. Remediation Upgrade github.com/microstack-tech/parallax/core/rawdb to version 0.1.4 or higher...

python-jwcrypto: malicious JWE token can cause denial of service

An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service...

Fedora 40 : firefox (2024-cd3a64f43b)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-cd3a64f43b advisory. - Updated to 124.0 ---- - Updated to latest upstream 123.0.1 Tenable has extracted the preceding description block directly from the Fedora security...

RHEL 8 : Red Hat OpenShift Data Foundation 4.11.0 (RHSA-2022:6155)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6155 advisory. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Re...