6 matches found
Improperly Controlled Sequential Memory Allocation
Overview Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation via generated flexible-protocol message readers that parse request headers. An attacker can send a request whose flexible header declares millions of unknown tagged fields, causing the...
CVE-2026-71276 Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...
CVE-2026-71276
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...
CVE-2026-71276
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...
PT-2026-68149
Name of the Vulnerable Software and Affected Versions Magistrala formerly Mainflux affected versions not specified Description The message-readers API reads a format value from the HTTP query string in readers/api/http/transport.go without validation. This value is interpolated directly into raw...
CVE-2026-71276: Improper Neutralization of Special Elements used in an SQL Command
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...