Ethereum RLPx 安全漏洞

Ethereum RLPx is a TCP-based transport protocol from Ethereum used for communication between Ethernet nodes. A security vulnerability exists in Ethereum RLPx that stems from two CTR streams based on the same key, IV, and random number, potentially facilitating decryption on a private network...

CVE-2015-20112

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

Private Continual Counting of Unbounded Streams

We study the problem of differentially private continual counting in the unbounded setting where the input size $n$ is not known in advance. Current state-of-the-art algorithms based on optimal instantiations of the matrix mechanism cannot be directly applied here because their privacy guarantees...

OESA-2025-1656 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

DEBIAN-CVE-2022-50049

In the Linux kernel, the following vulnerability has been resolved: ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcmaddpaths, it doesn't check whether the picked BE actually supports for the given stream direction. Due to that, when an asymmetric ...

Security Bulletin: IBM Event Streams is vulnerable to Server Side Request Forgery (SSRF) due to the axios component (CVE-2025-27152).

Summary IBM Event Streams is vulnerable to Server Side Request Forgery SSRF due to the axios component. In event streams, axios is used to make HTTP requests to the Event Streams REST Admin API, such as creating or listing Kafka topics. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axio...

Malicious code in electron-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91208cc2a76d45e148c93d7469a0c3f62f107923f3f3829a15facb4fb20d0d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4824 Malicious code in electron-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91208cc2a76d45e148c93d7469a0c3f62f107923f3f3829a15facb4fb20d0d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-5918

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

CVE-2025-5918

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

CVE-2025-5918

CVE-2025-5918 is a libarchive vulnerability where piping file streams into bsdtar can trigger an out-of-bounds read, potentially causing memory corruption or DoS. The issue is documented across multiple platforms (including Debian, CBL-Mariner, and macOS security notes) and is associated with the...

CVE-2025-5918 Libarchive: reading past eof may be triggered for piped file streams

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

Denial Of Service (DoS)

github.com/coredns/coredns is vulnerable to Denial of Service DoS. The vulnerability is due to lack of limits on concurrent QUIC streams and goroutines per connection, allowing an attacker to exhaust memory by opening many streams simultaneously...

libarchive 缓冲区错误漏洞

libarchive is a multi-format archive and compression library open-sourced by libarchive. A buffer error vulnerability exists in libarchive, which stems from an out-of-bounds read when bsdtar handles file streams, which could result in memory corruption or denial of service...

CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

Summary A Denial of Service DoS vulnerability was discovered in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticate...

GHSA-CVX7-X8PJ-X2GW CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

Summary A Denial of Service DoS vulnerability was discovered in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticate...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the DNS-over-QUIC DoQ server implementation. An attacker can cause uncontrolled memory consumption and potentially crash the system by opening many streams. Note: This is only...

CVE-2025-47950

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...

AZL-63678 CVE-2025-47950 affecting package coredns for versions less than 1.11.4-7

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...

AZL-63695 CVE-2025-47950 affecting package coredns for versions less than 1.11.1-19

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...