GHSA-473Q-M89C-GHF8 MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

Summary With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g.,...

GHSA-8QX7-J2V2-X6Q5 Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

AI Disclosure This vulnerability was discovered via deepseek-v4-pro1m for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than...

GHSA-M65P-9J7Q-6W33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

GHSA-J7QQ-VR8C-XVW3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

GHSA-X94G-W73Q-HPCW dd-trace: ReDOS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-MF2P-H6HF-FCWM TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

GHSA-W4FH-QVV9-3V23 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

GHSA-F5M9-JFRJ-JJJ7 OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

Summary JaegerPropagator.extract in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept...

GHSA-5H93-6WHR-6Q8J Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client for example an X-API-Key credential were sent to that origin, an...

GHSA-RWRF-2PQF-9J8J Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Summary In affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK's client validated each calltool result with jsonschema's default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https://...

GHSA-V6MG-96C6-GMPQ CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code...

GHSA-RH54-VFFM-5FVP CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

GHSA-5CP7-FP4J-WWCV Neko: Authorization bypass in legacy WebRTC input handling

Impact When legacy mode is enabled and session.implicithosting is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in LegacyIsHost. As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC...

GHSA-RJH2-4XGW-P2HJ Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

GHSA-MGQF-5MF5-PRFJ FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

GHSA-QRXM-FQHP-JWVM undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

Impact undici crashes the client process when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the...

GHSA-9FM3-97PX-RJF6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the receiver automatically writes a PONG response to the socket and ignores the false return val...

GHSA-F897-62HF-6GXQ MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless...

GHSA-R925-MGVR-H9CC Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Description HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the...

GHSA-MGCC-CWW5-FP2Q Go JOSE: DoS when parsing JWKs that contain RSA keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate. On Go 1.24+, this takes cubic time complexit...

GHSA-VG84-C5MG-76XH CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Impact CTFer.io's CTFd Terraform Provider stores ctfdteam.password as non-sensitive values CWE-522. A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. Patches Patched in v2.8.2. Workarounds No...

GHSA-WF6J-7HVR-GR93 Hydra legacy target blacklist permits unsafe PyYAML loading

Summary Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate, a target such as yaml.unsafeload can execute Python code through a config-controlled YAML stream containing Python object-construction...

GHSA-6PQ8-JHM2-2VCW qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

Summary qs.stringifyobj, arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property for example a: toString: 'x' . A remote, unauthenticated attacker who can influence an...

GHSA-QQ8J-7V2V-3RWP undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...

GHSA-8M4G-J4WP-WGCG Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...

GHSA-VP88-798V-H67F rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello ECH. When the server rejects ECH, the client completes the handshake with the outer ClientHello and authenticates the serv...

GHSA-W44R-93J7-QV28 rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

Summary The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects X25519 and close the connection. Later...

GHSA-C8M5-C952-6CM4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Summary Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store...

GHSA-H2V8-394M-P7VV Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Summary The built-in but disabled by default Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator cannot satisfy that request. A client must enable...

GHSA-X4RV-C3WX-4CR8 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...

GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

GHSA-FCH4-3C6X-J4GC Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...

GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

GHSA-7VR2-2FGP-9W7P Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...

GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

GHSA-J2W7-387V-M2RQ PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...

GHSA-3X94-M842-937C PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...

GHSA-RXJ4-H86G-25GC PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...

GHSA-FPMH-FRQ8-7RJ8 compress zstd: Panic on two-block frames

Summary A crafted 27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic with an out-of-range slice index instead of returning a decode error. The same bytes decode fine with the reference zstd. Any program that decompresses untrusted zstd input can be crashed by it. Reproduce...

GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...

GHSA-45C3-73F7-PV4M dnspython dns.name.from_wire_parser() excessive CPU use

Impact A maliciously crafted DNS message may cause dns.name.fromwireparser to use excessive CPU for DNS name decompression. Applications that process untrusted DNS wire form messages with dnspython may be degraded or DoS'd by the extra CPU use required. Patches This problem is fixed in dnspython...

GHSA-3633-R77Q-H3V3 Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-P3M5-H5V9-VQJ6 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

GHSA-98QM-WVGF-W4CF MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

Impact The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decodeall accept mmap and array buffers, whi...

GHSA-H3RC-6MM3-GC2M vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

GHSA-3W55-933P-8PV5 Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Summary The FileSessionManager defaults to storing session data in /tmp/strands/sessions/ a world-writable directory using predictable file paths and a write pattern openpath + ".tmp", "w" → os.replace that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or...

GHSA-763V-5PJM-FX36 Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...

GHSA-GWQ9-9FFJ-MVRV snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

Impact Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declare...

GHSA-XQRX-QH46-34M7 snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

Impact Snappy.arrayCopyObject src, int offset, int byteLength, Object dest, int destOffset called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and...

GHSA-Q233-G92Q-QXP6 snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

Impact Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing...