CVE-2022-38667

CVE-2022-38667 affects Crow HTTP applications up to and including 1.0+4. The issue is a Use-After-Free that can lead to code execution when HTTP pipelining is used. The root cause is that the HTTP parser supports pipelining, but the asynchronous Connection layer does not track the progression of ...

CVE-2022-34970

The CVE-2022-34970 entry affects Crow v1.0+4 and is caused by a heap-based overflow in the qs_parse function of query_string.h. On successful exploitation, remote code execution in the context of the vulnerable Crow service is possible. The Red Hat and OSV/NVD entries corroborate this description...