CWE-252
AllowedUnchecked Return Value
Abstraction: Base · Status: Draft
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
238 vulnerabilities reference this CWE, most recent first.
GHSA-25CX-9M6G-83WV
Vulnerability from github – Published: 2024-07-10 09:30 – Updated: 2024-10-31 00:30In the Linux kernel, the following vulnerability has been resolved:
mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown
The return value of pm_runtime_get_sync() in cmdq_mbox_shutdown() will return 1 when pm runtime state is active, and we don't want to get the warning message in this case.
So we change the return value < 0 for WARN_ON().
{
"affected": [],
"aliases": [
"CVE-2024-39492"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T08:15:11Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown\n\nThe return value of pm_runtime_get_sync() in cmdq_mbox_shutdown()\nwill return 1 when pm runtime state is active, and we don\u0027t want to\nget the warning message in this case.\n\nSo we change the return value \u003c 0 for WARN_ON().",
"id": "GHSA-25cx-9m6g-83wv",
"modified": "2024-10-31T00:30:36Z",
"published": "2024-07-10T09:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39492"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2d42a37a4518478f075ccf848242b4a50e313a46"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/747a69a119c469121385543f21c2d08562968ccc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-27MX-GCHC-6XJP
Vulnerability from github – Published: 2022-06-11 00:00 – Updated: 2022-06-17 00:40This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "posix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21211"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-17T00:40:15Z",
"nvd_published_at": "2022-06-10T20:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.",
"id": "GHSA-27mx-gchc-6xjp",
"modified": "2022-06-17T00:40:15Z",
"published": "2022-06-11T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21211"
},
{
"type": "PACKAGE",
"url": "https://github.com/ohmu/node-posix"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-POSIX-2400719"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Unhandled crash in npm posix"
}
GHSA-27W2-87XV-37C6
Vulnerability from github – Published: 2026-05-15 16:31 – Updated: 2026-06-08 20:14Impact
A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics.
Patches
The patch for this vulnerability is formally released as part of v1.4.0.
Workarounds
No known workarounds.
Resources
See PR.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "nimiq-keys"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40092"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-15T16:31:22Z",
"nvd_published_at": "2026-05-20T22:16:36Z",
"severity": "HIGH"
},
"details": "### Impact\nA malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a `TaggedSigned\u003cValidatorRecord, KeyPair\u003e` with a signature field whose byte length is not exactly 64. When the victim node\u0027s DHT verifier calls `TaggedSigned::verify`, execution reaches `Ed25519Signature::from_bytes(sig).unwrap()` in the `TaggedPublicKey` implementation for `Ed25519PublicKey`. The `from_bytes` call fails because `ed25519_zebra::Signature::try_from` rejects slices not 64 bytes, and the `unwrap()` panics. The BLS `TaggedPublicKey` implementation correctly returns `false` on error; only the Ed25519 implementation panics.\n\n### Patches\n[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3708) is formally released as part of [v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0).\n\n### Workarounds\nNo known workarounds.\n\n### Resources\nSee [PR](https://github.com/nimiq/core-rs-albatross/pull/3708).",
"id": "GHSA-27w2-87xv-37c6",
"modified": "2026-06-08T20:14:54Z",
"published": "2026-05-15T16:31:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-27w2-87xv-37c6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40092"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/pull/3708"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/commit/807ee8e99a7ccdc604d49971f292854bfa36754d"
},
{
"type": "PACKAGE",
"url": "https://github.com/nimiq/core-rs-albatross"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT"
}
GHSA-2CH9-GMHF-H625
Vulnerability from github – Published: 2024-06-12 18:30 – Updated: 2024-06-12 18:30CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2024-37039"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-12T17:15:51Z",
"severity": "MODERATE"
},
"details": "CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the\ndevice when an attacker sends a specially crafted HTTP request.",
"id": "GHSA-2ch9-gmhf-h625",
"modified": "2024-06-12T18:30:41Z",
"published": "2024-06-12T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37039"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2PFX-377Q-35VR
Vulnerability from github – Published: 2024-11-19 21:31 – Updated: 2024-11-19 21:31Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
{
"affected": [],
"aliases": [
"CVE-2024-45419"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-19T20:15:30Z",
"severity": "HIGH"
},
"details": "Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.",
"id": "GHSA-2pfx-377q-35vr",
"modified": "2024-11-19T21:31:33Z",
"published": "2024-11-19T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45419"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24041"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3288-CWGW-CH86
Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2021-08-19 17:44An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "xcb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26955"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T17:44:05Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.",
"id": "GHSA-3288-cwgw-ch86",
"modified": "2021-08-19T17:44:05Z",
"published": "2021-08-25T20:53:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26955"
},
{
"type": "WEB",
"url": "https://github.com/RustSec/advisory-db/issues/653"
},
{
"type": "PACKAGE",
"url": "https://github.com/rtbo/rust-xcb"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Unchecked Return Value in xcb"
}
GHSA-32PR-WG5J-9RWR
Vulnerability from github – Published: 2022-08-25 00:00 – Updated: 2025-06-09 15:31A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
{
"affected": [],
"aliases": [
"CVE-2021-3998"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-24T16:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.",
"id": "GHSA-32pr-wg5j-9rwr",
"modified": "2025-06-09T15:31:33Z",
"published": "2022-08-25T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3998"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3998"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024633"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-3998"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221020-0003"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28770"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=84d2d0fe20bdf94feed82b21b4d7d136db471f03"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ee8d5e33adb284601c00c94687bc907e10aec9bb"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/01/24/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-336C-XVXH-5C25
Vulnerability from github – Published: 2023-07-07 12:30 – Updated: 2024-04-04 05:50The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
{
"affected": [],
"aliases": [
"CVE-2020-8934"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-07T12:15:09Z",
"severity": "MODERATE"
},
"details": "The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.\n",
"id": "GHSA-336c-xvxh-5c25",
"modified": "2024-04-04T05:50:22Z",
"published": "2023-07-07T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8934"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-site-kit/site-kit-by-google-171-sensitive-information-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-359H-VJP2-HP47
Vulnerability from github – Published: 2022-05-13 01:12 – Updated: 2022-05-13 01:12A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.
{
"affected": [],
"aliases": [
"CVE-2018-14622"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-30T13:29:00Z",
"severity": "HIGH"
},
"details": "A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.",
"id": "GHSA-359h-vjp2-hp47",
"modified": "2022-05-13T01:12:25Z",
"published": "2022-05-13T01:12:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14622"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2017:1991"
},
{
"type": "WEB",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=968175"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14622"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00034.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3759-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3759-2"
},
{
"type": "WEB",
"url": "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=1c77f7a869bdea2a34799d774460d1f9983d45f0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3CJ3-JRRP-9RXF
Vulnerability from github – Published: 2021-08-25 20:53 – Updated: 2021-08-19 17:44An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "xcb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26958"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T17:44:11Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.",
"id": "GHSA-3cj3-jrrp-9rxf",
"modified": "2021-08-19T17:44:11Z",
"published": "2021-08-25T20:53:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26958"
},
{
"type": "WEB",
"url": "https://github.com/RustSec/advisory-db/issues/653"
},
{
"type": "PACKAGE",
"url": "https://github.com/rtbo/rust-xcb"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0019.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Unchecked Return Value in xcb"
}
Mitigation MIT-53
Check the results of all functions that return a value and verify that the value is expected.
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Ensure that you account for all possible return values from the function.
Mitigation
When designing a function, make sure you return a value or throw an exception in case of an error.
No CAPEC attack patterns related to this CWE.