Common Weakness Enumeration

CWE-195

Allowed

Signed to Unsigned Conversion Error

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

52 vulnerabilities reference this CWE, most recent first.

GHSA-QPJH-GXXF-V482

Vulnerability from github – Published: 2026-10-14 18:32 – Updated: 2026-10-15 18:32
VLAI
Details

Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model.

Severity
2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-110735"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T16:17:44Z",
    "severity": "LOW"
  },
  "details": "Godot Engine through 4.7.2 has a heap out-of-bounds write exists in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier\u0027s position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model.",
  "id": "GHSA-qpjh-gxxf-v482",
  "modified": "2026-10-15T18:32:06Z",
  "published": "2026-10-14T18:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/godotengine/godot/issues/123608"
    },
    {
      "type": "WEB",
      "url": "https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/15/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QXW6-2W65-G7RG

Vulnerability from github – Published: 2026-09-16 21:32 – Updated: 2026-09-16 21:32
VLAI
Details

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload.

This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-20248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T21:17:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS\u0026nbsp;response handler to unexpectedly restart, causing the device to reload.\n\nThis vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition.\nNote: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.",
  "id": "GHSA-qxw6-2w65-g7rg",
  "modified": "2026-09-16T21:32:49Z",
  "published": "2026-09-16T21:32:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20248"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tcpdns-dos-p6dUnjr5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R9CH-9WX4-F978

Vulnerability from github – Published: 2026-09-30 00:32 – Updated: 2026-09-30 00:32
VLAI
Details

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-74221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T22:18:33Z",
    "severity": "HIGH"
  },
  "details": "U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.",
  "id": "GHSA-r9ch-9wx4-f978",
  "modified": "2026-09-30T00:32:29Z",
  "published": "2026-09-30T00:32:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74221"
    },
    {
      "type": "WEB",
      "url": "https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/u-boot/u-boot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L643"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-readlink"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RM6M-HRCW-JW33

Vulnerability from github – Published: 2026-09-17 17:04 – Updated: 2026-09-17 17:04
VLAI
Summary
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
Details

Summary

A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service (Qos) configuration method. The Qos function accepts signed integers (int) for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers (uint16 and uint32, respectively) when formatting the wire-level frame.

If a developer passes a negative integer (such as -1) to these parameters—frequently intended as a sentinel value meaning "no change" or "no limit"—the application performs an implicit signed-to-unsigned conversion. This wraps the values to their absolute maximum limit ($65535$ and $4294967295$). Consequently, a consumer expecting restricted message delivery rates is suddenly flooded with an unlimited volume of messages, potentially exhausting memory resources and crashing the application.

Vulnerability Details

Mechanism

The bug manifests during the structural assignment inside the channel's Qos method:

// channel.go:795-796
PrefetchCount: uint16(prefetchCount),  // -1 wraps to 65535
PrefetchSize:  uint32(prefetchSize),   // -1 wraps to 4294967295

In Go, converting a negative signed integer to an unsigned integer shifts the value via two's complement arithmetic. Because no boundary validation or signedness check occurs prior to the cast: * Passing -1 for prefetchCount yields a wire value of 65535. * Passing -1 for prefetchSize yields a wire value of 4294967295.

Impact

The AMQP broker interprets a prefetch-count of 65535 as an instruction to dispatch messages to the consumer with virtually no concurrency limits.

If the application is processing heavy payloads or relies on strict rate-limiting to maintain stability, this unexpected flood will cause rapid heap memory growth, unmanageable processing queues, and an eventual Out-Of-Memory (OOM) termination.

Attack Vector

An attacker who can manipulate configuration files, environmental variables, or API inputs that dictate client Qos settings can trigger an application-layer Denial of Service:

  1. Malicious Input: An attacker sets a service's prefetch configuration parameter to -1.
  2. Implicit Overflow: The application initializes the channel, executes Qos(-1, ...), and transmits an unintended maximum-capacity request to the RabbitMQ/AMQP broker.
  3. Consumer Exhaustion: The broker flushes the entire contents of the queue directly into the client consumer's network buffer, bypassing expected application concurrency barriers and inducing a crash.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rabbitmq/amqp091-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:04:05Z",
    "nvd_published_at": "2026-09-16T15:17:49Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nA logic and resource exhaustion vulnerability exists in the AMQP client\u0027s Quality of Service (`Qos`) configuration method. The `Qos` function accepts signed integers (`int`) for the `prefetchCount` and `prefetchSize` parameters but casts them directly to unsigned integers (`uint16` and `uint32`, respectively) when formatting the wire-level frame.\n\nIf a developer passes a negative integer (such as `-1`) to these parameters\u2014frequently intended as a sentinel value meaning \"no change\" or \"no limit\"\u2014the application performs an implicit signed-to-unsigned conversion. This wraps the values to their absolute maximum limit ($65535$ and $4294967295$). Consequently, a consumer expecting restricted message delivery rates is suddenly flooded with an unlimited volume of messages, potentially exhausting memory resources and crashing the application.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe bug manifests during the structural assignment inside the channel\u0027s `Qos` method:\n\n```go\n// channel.go:795-796\nPrefetchCount: uint16(prefetchCount),  // -1 wraps to 65535\nPrefetchSize:  uint32(prefetchSize),   // -1 wraps to 4294967295\n```\n\nIn Go, converting a negative signed integer to an unsigned integer shifts the value via two\u0027s complement arithmetic. Because no boundary validation or signedness check occurs prior to the cast:\n* Passing `-1` for `prefetchCount` yields a wire value of `65535`.\n* Passing `-1` for `prefetchSize` yields a wire value of `4294967295`.\n\n### Impact\nThe AMQP broker interprets a `prefetch-count` of `65535` as an instruction to dispatch messages to the consumer with virtually no concurrency limits. \n\nIf the application is processing heavy payloads or relies on strict rate-limiting to maintain stability, this unexpected flood will cause rapid heap memory growth, unmanageable processing queues, and an eventual Out-Of-Memory (OOM) termination.\n\n---\n\n## Attack Vector\nAn attacker who can manipulate configuration files, environmental variables, or API inputs that dictate client Qos settings can trigger an application-layer Denial of Service:\n\n1. **Malicious Input:** An attacker sets a service\u0027s prefetch configuration parameter to `-1`.\n2. **Implicit Overflow:** The application initializes the channel, executes `Qos(-1, ...)`, and transmits an unintended maximum-capacity request to the RabbitMQ/AMQP broker.\n3. **Consumer Exhaustion:** The broker flushes the entire contents of the queue directly into the client consumer\u0027s network buffer, bypassing expected application concurrency barriers and inducing a crash.",
  "id": "GHSA-rm6m-hrcw-jw33",
  "modified": "2026-09-17T17:04:05Z",
  "published": "2026-09-17T17:04:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77406"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/351"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/amqp091-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration"
}

GHSA-V6X3-9R38-R27Q

Vulnerability from github – Published: 2025-12-14 06:30 – Updated: 2025-12-16 19:30
VLAI
Summary
Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short
Details

In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "sequoia-openpgp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-67897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-16T19:30:41Z",
    "nvd_published_at": "2025-12-14T05:16:06Z",
    "severity": "MODERATE"
  },
  "details": "In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.",
  "id": "GHSA-v6x3-9r38-r27q",
  "modified": "2025-12-16T19:30:41Z",
  "published": "2025-12-14T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67897"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/1122582"
    },
    {
      "type": "PACKAGE",
      "url": "https://gitlab.com/sequoia-pgp/sequoia"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0136.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short"
}

GHSA-VR3H-29QC-JVJF

Vulnerability from github – Published: 2025-11-24 15:30 – Updated: 2025-11-24 15:30
VLAI
Details

Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-65495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-24T14:15:47Z",
    "severity": "HIGH"
  },
  "details": "Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.",
  "id": "GHSA-vr3h-29qc-jvjf",
  "modified": "2025-11-24T15:30:29Z",
  "published": "2025-11-24T15:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65495"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/issues/1744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/pull/1750"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-W33C-445M-F8W7

Vulnerability from github – Published: 2023-07-12 21:30 – Updated: 2023-07-13 17:01
VLAI
Summary
Okio Signed to Unsigned Conversion Error vulnerability
Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.squareup.okio:okio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-RC1"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.squareup.okio:okio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.squareup.okio:okio-jvm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-RC1"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-3635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195",
      "CWE-681"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-13T17:01:48Z",
    "nvd_published_at": "2023-07-12T19:15:08Z",
    "severity": "MODERATE"
  },
  "details": "GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n",
  "id": "GHSA-w33c-445m-f8w7",
  "modified": "2023-07-13T17:01:48Z",
  "published": "2023-07-12T21:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/okio/pull/1280"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/okio/pull/1334"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/square/okio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176"
    },
    {
      "type": "WEB",
      "url": "https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Okio Signed to Unsigned Conversion Error vulnerability"
}

GHSA-W4PV-VQP3-F753

Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-06-09 18:31
VLAI
Details

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-3045"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-03-22T16:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.",
  "id": "GHSA-w4pv-vqp3-f753",
  "modified": "2025-06-09T18:31:54Z",
  "published": "2022-05-13T01:27:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3045"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=799000"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/chromium/issues/detail?id=116162"
    },
    {
      "type": "WEB",
      "url": "http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html"
    },
    {
      "type": "WEB",
      "url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b"
    },
    {
      "type": "WEB",
      "url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commit;h=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0407.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0488.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48320"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48485"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48512"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48554"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/49660"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-201206-15.xml"
    },
    {
      "type": "WEB",
      "url": "http://src.chromium.org/viewvc/chrome?view=rev\u0026revision=125311"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2012/dsa-2439"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:033"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1026823"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WFGH-7J4X-4XJQ

Vulnerability from github – Published: 2026-09-04 00:31 – Updated: 2026-09-04 00:31
VLAI
Details

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-85441"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T23:17:23Z",
    "severity": "HIGH"
  },
  "details": "MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator\u003e\u003e. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.",
  "id": "GHSA-wfgh-7j4x-4xjq",
  "modified": "2026-09-04T00:31:09Z",
  "published": "2026-09-04T00:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85441"
    },
    {
      "type": "WEB",
      "url": "https://github.com/themoos/core-moos/pull/74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/themoos/core-moos/commit/04c92981091fdaa2ff85e2ba7eff94f6288bdbaf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/themoos/core-moos"
    },
    {
      "type": "WEB",
      "url": "https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSMsg.cpp#L453"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-denial-of-service-via-negative-serialized-string-length"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-X379-72WQ-8VWF

Vulnerability from github – Published: 2024-02-06 09:31 – Updated: 2024-02-06 09:31
VLAI
Details

Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-28063"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-195",
      "CWE-681"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-06T08:15:46Z",
    "severity": "MODERATE"
  },
  "details": "\nDell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.\n\n",
  "id": "GHSA-x379-72wq-8vwf",
  "modified": "2024-02-06T09:31:38Z",
  "published": "2024-02-06T09:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28063"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000214780/dsa-2023-176-dell-client-bios-security-update-for-a-signed-to-unsigned-conversion-error-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list