Common Weakness Enumeration

CWE-121

Allowed

Stack-based Buffer Overflow

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

5237 vulnerabilities reference this CWE, most recent first.

GHSA-7P3H-RRXF-82F3

Vulnerability from github – Published: 2023-01-12 00:30 – Updated: 2023-01-19 21:30
VLAI
Details

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_utc, at 0x9d0193ac, the value for the offset key is copied using strcpy to the buffer at $sp+0x2d0.This buffer is 100 bytes large, sending anything longer will cause a buffer overflow.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-16289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-11T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the \"cc\" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_utc, at 0x9d0193ac, the value for the `offset` key is copied using `strcpy` to the buffer at `$sp+0x2d0`.This buffer is 100 bytes large, sending anything longer will cause a buffer overflow.",
  "id": "GHSA-7p3h-rrxf-82f3",
  "modified": "2023-01-19T21:30:26Z",
  "published": "2023-01-12T00:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16289"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7P55-F535-V7G3

Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31
VLAI
Details

D-Link DIR-X3260 prog.cgi SetTriggerPPPoEValidate Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21672.

Severity
6.8 (Medium)
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-51622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:16:25Z",
    "severity": "MODERATE"
  },
  "details": "D-Link DIR-X3260 prog.cgi SetTriggerPPPoEValidate Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21672.",
  "id": "GHSA-7p55-f535-v7g3",
  "modified": "2024-05-03T03:31:10Z",
  "published": "2024-05-03T03:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51622"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-042"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7P64-F72W-3RPR

Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31
VLAI
Details

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-25823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:54:27Z",
    "severity": "CRITICAL"
  },
  "details": "HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.",
  "id": "GHSA-7p64-f72w-3rpr",
  "modified": "2026-03-13T21:31:46Z",
  "published": "2026-03-13T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25823"
    },
    {
      "type": "WEB",
      "url": "https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2026-03-09-001---ewon-several-flexy-and-cosy--vulnerabilities.pdf?sfvrsn=f7c027b8_13"
    },
    {
      "type": "WEB",
      "url": "https://www.hms-networks.com/p/flexy20500-00ma-ewon-flexy-205"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7P75-39P6-7499

Vulnerability from github – Published: 2026-01-23 06:31 – Updated: 2026-01-23 06:31
VLAI
Details

ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the Replaces header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28300.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-0791"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T04:16:06Z",
    "severity": "HIGH"
  },
  "details": "ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the Replaces header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28300.",
  "id": "GHSA-7p75-39p6-7499",
  "modified": "2026-01-23T06:31:25Z",
  "published": "2026-01-23T06:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0791"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-013"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7PMG-VMJ4-QJP4

Vulnerability from github – Published: 2024-04-17 00:30 – Updated: 2024-04-26 09:30
VLAI
Details

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-21053"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-16T22:15:22Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
  "id": "GHSA-7pmg-vmj4-qjp4",
  "modified": "2024-04-26T09:30:34Z",
  "published": "2024-04-17T00:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21053"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240426-0012"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7PQW-F6RF-898V

Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31
VLAI
Details

D-Link DIR-X3260 prog.cgi SetWanSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21594.

Severity
6.8 (Medium)
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-51617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:16:24Z",
    "severity": "MODERATE"
  },
  "details": "D-Link DIR-X3260 prog.cgi SetWanSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21594.",
  "id": "GHSA-7pqw-f6rf-898v",
  "modified": "2024-05-03T03:31:10Z",
  "published": "2024-05-03T03:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51617"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-037"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7Q29-7R79-PG2F

Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2024-07-03 18:40
VLAI
Details

TOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-34200"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:38:33Z",
    "severity": "HIGH"
  },
  "details": "TOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function.",
  "id": "GHSA-7q29-7r79-pg2f",
  "modified": "2024-07-03T18:40:52Z",
  "published": "2024-05-14T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34200"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n0wstr/IOTVuln/tree/main/CP450/setIpQosRules"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7Q36-4XX7-XCXF

Vulnerability from github – Published: 2020-01-31 17:59 – Updated: 2024-10-16 22:06
VLAI
Summary
Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack
Details

Impact

When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors:

  1. hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized.
  2. stack overflow - leading to the deserializing process crashing.

Patches

The following steps are required to mitigate this risk.

  1. Upgrade to a version of the library where a fix is available
  2. Add code to your application to put MessagePack into the defensive UntrustedData mode.
  3. Identify all MessagePack extensions that implement IMessagePackFormatter<T> implementations that do not ship with the MessagePack library to include the security mitigations. This includes those acquired from 3rd party packages and classes included directly into your project. Any AOT formatters generated with the MPC tool must be regenerated with the patched version of mpc.
  4. Review your messagepack-serializable data structures for hash-based collections that use custom or unusual types for the hashed key. See below for details on handling such situations.

Review the MessagePackSecurity class to tweak any settings as necessary to strike the right balance between performance, functionality, and security.

Specialized IEqualityComparer<T> implementations provide the hash collision resistance. Each type of hashed key may require a specialized implementation of its own. The patched MessagePack library includes many such implementations for primitive types commonly used as keys in hash-based collections. If your data structures use custom types as keys in these hash-based collections, putting MessagePack in UntrustedData mode may lead the deserializer to throw an exception because no safe IEqualityComparer<T> is available for your custom T type. You can provide your own safe implementation by deriving from the MessagePackSecurity class and overriding the GetHashCollisionResistantEqualityComparer<T>() method to return your own custom implementation when T matches your type, and fallback to return base.GetHashCollisionResistantEqualityComparer<T>(); for types you do not have custom implementations for.

Unrelated to this advisory, but as general security guidance, you should also avoid the Typeless serializer/formatters/resolvers for untrusted data as that opens the door for the untrusted data to potentially deserialize unanticipated types that can compromise security.

MessagePack 1.x users

  1. Upgrade to any 1.9.x version.

  2. When deserializing untrusted data, put MessagePack into a more secure mode with:

    cs MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;

    In MessagePack v1.x this is a static property and thus the security level is shared by the entire process or AppDomain. Use MessagePack v2.1 or later for better control over the security level for your particular use.

  3. Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called Generated.cs. A patched Generated.cs file will typically reference the MessagePackSecurity class.

    Review any custom-written IMessagePackFormatter<T> implementations in your project or that you might use from 3rd party packages to ensure they also utilize the MessagePackSecurity class as required. In particular, a formatter that deserializes an object (as opposed to a primitive value) should wrap the deserialization in a using (MessagePackSecurity.DepthStep()) block. For example:

    cs public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options) { if (reader.TryReadNil()) { return default; } else { using (MessagePackSecurity.DepthStep()) // STACK OVERFLOW MITIGATION { MyObject o = new MyObject(); // deserialize members of the object here. return o; } } }

    If your custom formatter creates hash-based collections (e.g. Dictionary<K, V> or HashSet<T>) where the hashed key comes from the messagepack data, always instantiate your collection using MessagePackSecurity.Active.GetEqualityComparer<T>() as the equality comparer:

    cs var collection = new HashSet<T>(MessagePackSecurity.Active.GetEqualityComparer<T>());

    This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.

Learn more about best security practices when reading untrusted data with MessagePack 1.x.

MessagePack 2.x users

  1. Upgrade to any 2.1.x or later version.

  2. When deserializing untrusted data, put MessagePack into a more secure mode by configuring your MessagePackSerializerOptions.Security property:

    ```cs var options = MessagePackSerializerOptions.Standard .WithSecurity(MessagePackSecurity.UntrustedData);

    // Pass the options explicitly for the greatest control. T object = MessagePackSerializer.Deserialize(data, options);

    // Or set the security level as the default. MessagePackSerializer.DefaultOptions = options; ```

  3. Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called Generated.cs. A patched Generated.cs file will typically reference the Security member on the MessagePackSerializerOptions parameter.

    Review any custom-written IMessagePackFormatter<T> implementations in your project or that you might use from 3rd party packages to ensure they also utilize the MessagePackSecurity class as required. In particular, a formatter that deserializes an object (as opposed to a primitive value) should call options.Security.DepthStep(ref reader); before deserializing the object's members, and be sure to revert the depth step with reader.Depth--; before exiting the method. For example:

    cs public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options) { if (reader.TryReadNil()) { return default; } else { options.Security.DepthStep(ref reader); // STACK OVERFLOW MITIGATION, line 1 try { MyObject o = new MyObject(); // deserialize members of the object here. return o; } finally { reader.Depth--; // STACK OVERFLOW MITIGATION, line 2 } } }

    If your custom formatter creates hash-based collections (e.g. Dictionary<K, V> or HashSet<T>) where the hashed key comes from the messagepack data, always instantiate your collection using options.Security.GetEqualityComparer<TKey>() as the equality comparer:

    cs var collection = new HashSet<T>(options.Security.GetEqualityComparer<T>());

    This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.

Learn more about best security practices when reading untrusted data with MessagePack 2.x.

Workarounds

The security vulnerabilities are in the formatters. Avoiding the built-in formatters entirely in favor of reading messagepack primitive data directly or relying on carefully written custom formatters can provide a workaround.

MessagePack v1.x users may utilize the MessagePackBinary static class directly to read the data they expect. MessagePack v2.x users may utilize the MessagePackReader struct directly to read the data they expect.

References

Learn more about best security practices when reading untrusted data with MessagePack 1.x or MessagePack 2.x.

For more information

If you have any questions or comments about this advisory:

Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.ImmutableCollection"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.ImmutableCollection"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.ReactiveProperty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.ReactiveProperty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.UnityShims"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.UnityShims"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.Unity"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "MessagePack.Unity"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5234"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-31T17:47:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nWhen this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by either of two vectors:\n\n1. hash collisions - leading to large CPU consumption disproportionate to the size of the data being deserialized.\n1. stack overflow - leading to the deserializing process crashing.\n\n### Patches\n\nThe following steps are required to mitigate this risk.\n\n1. Upgrade to a version of the library where a fix is available\n1. Add code to your application to put MessagePack into the defensive `UntrustedData` mode.\n1. Identify all MessagePack extensions that implement `IMessagePackFormatter\u003cT\u003e` implementations that do not ship with the MessagePack library to include the security mitigations. This includes those acquired from 3rd party packages and classes included directly into your project. Any AOT formatters generated with the MPC tool must be regenerated with the patched version of mpc.\n1. Review your messagepack-serializable data structures for hash-based collections that use custom or unusual types for the hashed key. See below for details on handling such situations.\n\nReview the `MessagePackSecurity` class to tweak any settings as necessary to strike the right balance between performance, functionality, and security.\n\nSpecialized `IEqualityComparer\u003cT\u003e` implementations provide the hash collision resistance.\nEach type of hashed key may require a specialized implementation of its own.\nThe patched MessagePack library includes many such implementations for primitive types commonly used as keys in hash-based collections.\nIf your data structures use custom types as keys in these hash-based collections,\nputting MessagePack in `UntrustedData` mode may lead the deserializer to throw an exception\nbecause no safe `IEqualityComparer\u003cT\u003e` is available for your custom `T` type.\nYou can provide your own safe implementation by deriving from the `MessagePackSecurity` class\nand overriding the `GetHashCollisionResistantEqualityComparer\u003cT\u003e()` method to return your own\ncustom implementation when `T` matches your type, and fallback to `return base.GetHashCollisionResistantEqualityComparer\u003cT\u003e();` for types you do not have custom implementations for.\n\nUnrelated to this advisory, but as general security guidance, you should also avoid the Typeless serializer/formatters/resolvers for untrusted data as that opens the door for the untrusted data to potentially deserialize unanticipated types that can compromise security.\n\n#### MessagePack 1.x users\n\n1. Upgrade to any 1.9.x version.\n\n1. When deserializing untrusted data, put MessagePack into a more secure mode with:\n\n    ```cs\n    MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;\n    ```\n\n    In MessagePack v1.x this is a static property and thus the security level is shared by the entire process or AppDomain.\n    Use MessagePack v2.1 or later for better control over the security level for your particular use.\n\n1. Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called `Generated.cs`. A patched `Generated.cs` file will typically reference the `MessagePackSecurity` class.\n\n    Review any custom-written `IMessagePackFormatter\u003cT\u003e` implementations in your project or that you might use from 3rd party packages to ensure they also utilize the `MessagePackSecurity` class as required.\n    In particular, a formatter that deserializes an object (as opposed to a primitive value) should wrap the deserialization in a `using (MessagePackSecurity.DepthStep())` block. For example:\n\n    ```cs\n    public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)\n    {\n        if (reader.TryReadNil())\n        {\n            return default;\n        }\n        else\n        {\n            using (MessagePackSecurity.DepthStep()) // STACK OVERFLOW MITIGATION\n            {\n                MyObject o = new MyObject();\n                // deserialize members of the object here.\n                return o;\n            }\n        }\n    }\n    ```\n\n    If your custom formatter creates hash-based collections (e.g. `Dictionary\u003cK, V\u003e` or `HashSet\u003cT\u003e`) where the hashed key comes from the messagepack data, always instantiate your collection using `MessagePackSecurity.Active.GetEqualityComparer\u003cT\u003e()` as the equality comparer:\n\n    ```cs\n    var collection = new HashSet\u003cT\u003e(MessagePackSecurity.Active.GetEqualityComparer\u003cT\u003e());\n    ```\n\n    This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.\n\nLearn more about [best security practices when reading untrusted data with MessagePack 1.x](https://github.com/neuecc/MessagePack-CSharp/tree/v1.x#security).\n\n#### MessagePack 2.x users\n\n1. Upgrade to any 2.1.x or later version.\n\n1. When deserializing untrusted data, put MessagePack into a more secure mode by configuring your `MessagePackSerializerOptions.Security` property:\n\n    ```cs\n    var options = MessagePackSerializerOptions.Standard\n        .WithSecurity(MessagePackSecurity.UntrustedData);\n\n    // Pass the options explicitly for the greatest control.\n    T object = MessagePackSerializer.Deserialize\u003cT\u003e(data, options);\n\n    // Or set the security level as the default.\n    MessagePackSerializer.DefaultOptions = options;\n    ```\n\n1. Any code produced by mpc should be regenerated with the mpc tool with the matching (patched) version. Such generated code usually is written to a file called `Generated.cs`. A patched `Generated.cs` file will typically reference the `Security` member on the `MessagePackSerializerOptions` parameter.\n\n    Review any custom-written `IMessagePackFormatter\u003cT\u003e` implementations in your project or that you might use from 3rd party packages to ensure they also utilize the `MessagePackSecurity` class as required.\n    In particular, a formatter that deserializes an object (as opposed to a primitive value) should call `options.Security.DepthStep(ref reader);` before deserializing the object\u0027s members, and be sure to revert the depth step with `reader.Depth--;` before exiting the method. For example:\n\n    ```cs\n    public MyObject Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)\n    {\n        if (reader.TryReadNil())\n        {\n            return default;\n        }\n        else\n        {\n            options.Security.DepthStep(ref reader); // STACK OVERFLOW MITIGATION, line 1\n            try\n            {\n                MyObject o = new MyObject();\n                // deserialize members of the object here.\n                return o;\n            }\n            finally\n            {\n                reader.Depth--; // STACK OVERFLOW MITIGATION, line 2\n            }\n        }\n    }\n    ```\n\n    If your custom formatter creates hash-based collections (e.g. `Dictionary\u003cK, V\u003e` or `HashSet\u003cT\u003e`) where the hashed key comes from the messagepack data, always instantiate your collection using `options.Security.GetEqualityComparer\u003cTKey\u003e()` as the equality comparer:\n\n    ```cs\n    var collection = new HashSet\u003cT\u003e(options.Security.GetEqualityComparer\u003cT\u003e());\n    ```\n\n    This ensures that when reading untrusted data, you will be using a collision-resistent hash algorithm.\n\nLearn more about [best security practices when reading untrusted data with MessagePack 2.x](https://github.com/neuecc/MessagePack-CSharp#security).\n\n### Workarounds\n\nThe security vulnerabilities are in the formatters.\nAvoiding the built-in formatters entirely in favor of reading messagepack primitive data directly\nor relying on carefully written custom formatters can provide a workaround.\n\nMessagePack v1.x users may utilize the `MessagePackBinary` static class directly to read the data they expect.\nMessagePack v2.x users may utilize the `MessagePackReader` struct directly to read the data they expect.\n\n### References\n\nLearn more about best security practices when reading untrusted data with [MessagePack 1.x](https://github.com/neuecc/MessagePack-CSharp/tree/v1.x#security) or [MessagePack 2.x](https://github.com/neuecc/MessagePack-CSharp#security).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [MessagePack-CSharp](https://github.com/neuecc/MessagePack-CSharp/issues/new/choose)\n* [Email us](mailto:andrewarnott@gmail.com)\n",
  "id": "GHSA-7q36-4xx7-xcxf",
  "modified": "2024-10-16T22:06:55Z",
  "published": "2020-01-31T17:59:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5234"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aspnet/Announcements/issues/405"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neuecc/MessagePack-CSharp/issues/810"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neuecc/MessagePack-CSharp/commit/56fa86219d01d0a183babbbbcb34abbdea588a02"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neuecc/MessagePack-CSharp/commit/f88684078698386df02204f13faeff098a61f007"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MessagePack-CSharp/MessagePack-CSharp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Untrusted data can lead to DoS attack due to hash collisions and stack overflow in MessagePack"
}

GHSA-7Q9J-8GPW-VMC6

Vulnerability from github – Published: 2024-02-23 03:30 – Updated: 2024-02-23 03:30
VLAI
Details

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-23T01:15:53Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-7q9j-8gpw-vmc6",
  "modified": "2024-02-23T03:30:39Z",
  "published": "2024-02-23T03:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1783"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/manishkumarr1017/30bca574e2f0a6d6336115ba71111984"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.254574"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.254574"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7QG3-C5C5-86RV

Vulnerability from github – Published: 2024-01-27 15:30 – Updated: 2024-01-27 15:30
VLAI
Details

A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-0962"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-27T13:15:07Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability.",
  "id": "GHSA-7qg3-c5c5-86rv",
  "modified": "2024-01-27T15:30:29Z",
  "published": "2024-01-27T15:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0962"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/issues/1310"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/issues/1310#issue-2099860835"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/pull/1311"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.252206"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.252206"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-10
Operation Build and Compilation

Strategy: Environment Hardening

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
  • D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Implementation

Implement and perform bounds checking on input.

Mitigation
Implementation

Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.

Mitigation MIT-11
Operation Build and Compilation

Strategy: Environment Hardening

  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
  • Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
  • For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

No CAPEC attack patterns related to this CWE.

← Back to the CWE list