CWE-617

{
  "affected": [],
  "aliases": [
    "CVE-2018-9252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-04T02:29:00Z",
    "severity": "MODERATE"
  },
  "details": "JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.",
  "id": "GHSA-5x2c-7cwv-6fv6",
  "modified": "2022-05-13T01:16:06Z",
  "published": "2022-05-13T01:16:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mdadams/jasper/issues/173"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-25675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-13T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile",
  "id": "GHSA-5x2p-vjm5-p7gj",
  "modified": "2022-12-15T18:30:23Z",
  "published": "2022-12-13T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25675"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-22T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS \u003c= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.",
  "id": "GHSA-5xmq-mwgg-pjp2",
  "modified": "2025-02-03T15:32:02Z",
  "published": "2025-01-22T18:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24429"
    },
    {
      "type": "WEB",
      "url": "https://cellularsecurity.org/ransacked"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-19519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T08:17:20Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in claircore\u0027s RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.",
  "id": "GHSA-639x-pgq6-48g2",
  "modified": "2026-08-11T09:32:33Z",
  "published": "2026-08-11T09:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19519"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-19519"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513781"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-6767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-01-16T19:28:00Z",
    "severity": "HIGH"
  },
  "details": "oftpd before 0.3.7 allows remote attackers to cause a denial of service (daemon abort) via a (1) LPRT or (2) LPASV command with an unsupported address family, which triggers an assertion failure.",
  "id": "GHSA-63cg-4vgw-wxjj",
  "modified": "2024-02-10T03:30:17Z",
  "published": "2022-05-01T07:41:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-6767"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31520"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/32822"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/23790"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/23797"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1017517"
    },
    {
      "type": "WEB",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200701-09.xml"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/22073"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/0198"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.0"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebra-network"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.1"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebrad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52829"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617",
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T20:26:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your node listens on the default `[::]` address on a Linux host (the standard deployment configuration \u2014 `net.ipv6.bindv6only=0` is the default on all common Linux distributions).\n3. Your node is synced near the chain tip (the expected production state for any node participating in the network).\n\n### Summary\n\nAn address normalization mismatch between the handshake path and the mempool misbehavior path causes a deterministic assertion panic when a peer connects via IPv4 to a dual-stack IPv6 listener and then triggers a mempool misbehavior penalty.\n\nThe handshake path canonicalizes IPv4-mapped IPv6 addresses to plain IPv4 when storing the peer in the address book via `MetaAddr::new_connected`. The mempool misbehavior path forwards the raw transient socket address (IPv4-mapped IPv6 form) when sending `MetaAddrChange::UpdateMisbehavior` to the address book. The address book looks up the canonical IPv4 entry but then asserts that the previous entry\u0027s address matches the change\u0027s address. The mismatch between the canonical IPv4 address and the raw IPv4-mapped IPv6 address triggers the assertion, and `panic = \"abort\"` terminates the process.\n\n### Details\n\nOn Linux with `net.ipv6.bindv6only=0`, an IPv4 connection accepted by a `[::]` listener is represented internally as an IPv4-mapped IPv6 socket address (e.g., `::ffff:127.0.0.1:8233`). Zebra\u0027s `canonical_peer_addr` helper converts these to plain IPv4 (e.g., `127.0.0.1:8233`).\n\nThe handshake path uses `MetaAddr::new_connected`, which canonicalizes the address before storing in the address book. However, inbound inventory registration uses `connected_addr.get_transient_addr()`, preserving the raw IPv4-mapped form. When the mempool later downloads an invalid transaction from this peer and generates a misbehavior penalty, the raw transient address is forwarded through the misbehavior channel to `MetaAddrChange::UpdateMisbehavior`, which does not canonicalize.\n\nAfter the 30-second misbehavior batch flush, `AddressBook::update` retrieves the canonical IPv4 entry but `MetaAddrChange::apply_to_meta_addr` asserts that `previous.addr == self.addr()`, which fails because one is IPv4 and the other is IPv4-mapped IPv6.\n\nThe attacker needs only to complete a P2P handshake over IPv4 to a dual-stack listener and advertise an invalid mempool transaction (such as a coinbase transaction). The assertion fires after the 30-second misbehavior batch flush.\n\n### Patches\n\nPatched in Zebra 4.5.0. The fix canonicalizes the address in the misbehavior update path via a new `MetaAddr::new_misbehavior` constructor that applies `canonical_peer_addr` before creating the `UpdateMisbehavior` change.\n\n### Workarounds\n\nConfiguring `listen_addr` to an IPv4-only address (e.g., `0.0.0.0:8233`) avoids the IPv4-mapped IPv6 representation and prevents this specific assertion. Alternatively, setting `net.ipv6.bindv6only=1` on Linux prevents dual-stack acceptance.\n\n### Impact\n\nA remote unauthenticated peer can deterministically crash any synced Zebra node running the default Linux dual-stack configuration with a single invalid mempool transaction advertisement, followed by a 30-second wait. The attack requires no mining capability, no RPC access, no funds, and no special privileges. The crash can be repeated after each restart, causing persistent downtime. Linux dual-stack sockets and mempool activation are the default production state, not special preconditions.\n\n### Credit\n\nReported by `@Haxatron`.",
  "id": "GHSA-63wg-wjjj-7cp8",
  "modified": "2026-07-02T20:26:56Z",
  "published": "2026-07-02T20:26:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ZcashFoundation/zebra"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Border Gateway Protocol (BGP) process to crash, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of a specific RPKI to Router (RTR) Protocol packet header. An attacker could exploit this vulnerability by compromising the RPKI validator server and sending a specifically crafted RTR packet to an affected device. Alternatively, the attacker could use man-in-the-middle techniques to impersonate the RPKI validator server and send a crafted RTR response packet over the established RTR TCP connection to the affected device. A successful exploit could allow the attacker to cause a DoS condition because the BGP process could constantly restart and BGP routing could become unstable.",
  "id": "GHSA-64wp-p24m-26g2",
  "modified": "2022-04-28T00:00:58Z",
  "published": "2022-04-16T00:00:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20694"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rpki-dos-2EgCNeKE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-37225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T17:16:58Z",
    "severity": "HIGH"
  },
  "details": "FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.",
  "id": "GHSA-65q7-226q-8whm",
  "modified": "2026-06-01T21:30:41Z",
  "published": "2026-06-01T18:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37225"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37225.md"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eurecom.fr/mosaic5g/flexric"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.grpc:grpc-protobuf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.51.0"
            },
            {
              "fixed": "1.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "grpcio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.51.0"
            },
            {
              "fixed": "1.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "grpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.51.0"
            },
            {
              "fixed": "1.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-1428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T23:56:28Z",
    "nvd_published_at": "2023-06-09T11:15:09Z",
    "severity": "HIGH"
  },
  "details": "There exists an vulnerability causing an abort() to be called in gRPC.\u00a0\nThe following headers cause gRPC\u0027s C++ implementation to abort() when called via http2:\n\nte: x (x != trailers)\n\n:scheme: x (x != http, https)\n\ngrpclb_client_stats: x (x == anything)\n\nOn top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit\u00a02485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.",
  "id": "GHSA-6628-q6j9-w8vg",
  "modified": "2025-08-13T15:05:17Z",
  "published": "2023-07-06T21:15:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1428"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc/issues/33463"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gRPC Reachable Assertion issue"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-56568"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-30T20:16:23Z",
    "severity": "HIGH"
  },
  "details": "Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Open5GS before v2.7.5 allows remote attackers to cause denial of service via specially crafted NGAP messages containing malformed length fields in protocol configuration data.",
  "id": "GHSA-66c2-wgqr-4j3m",
  "modified": "2026-05-04T18:30:28Z",
  "published": "2026-04-30T21:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56568"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open5gs/open5gs/issues/3969"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open5gs/open5gs/commit/d7707879c943d2c952235382154d835b5849d54e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}