Common Weakness Enumeration
CWE-670
Allowed-with-ReviewAlways-Incorrect Control Flow Implementation
Abstraction: Class · Status: Draft
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
217 vulnerabilities reference this CWE, most recent first.
GHSA-W6WJ-G5CV-FH4W
Vulnerability from github – Published: 2023-04-11 00:30 – Updated: 2025-04-23 18:30
VLAI
Details
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-1668"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-10T22:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.",
"id": "GHSA-w6wj-g5cv-fh4w",
"modified": "2025-04-23T18:30:42Z",
"published": "2023-04-11T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1668"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137666"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-16"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5387"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/04/06/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W9G2-3W7P-72G9
Vulnerability from github – Published: 2023-04-24 22:33 – Updated: 2024-11-19 16:31
VLAI
Summary
Incorrect success value returned in vyper
Details
Background
During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses raw_call: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 .
Construction like this:
success = raw_call(
sealable,
_abi_encode(SEAL_DURATION_SECONDS, method_id=method_id("pauseFor(uint256)")),
revert_on_failure=False
)
was not fully documented: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call .
The documentation says that: if max_outsize=0 it should return nothing and then it says that if revert_on_failure=False it should return a success flag in the tuple of response, but what if max_outsize=0 and revert_on_failure=False.
So the team started researching what exactly happened in that case, after some research we found that the Vyper compiler generates the wrong bytecode in that case, it generates the sequence:
CALL // call
MLOAD // MLOAD is wrong since the CALL result is already stored in the stack
Impact
Example of buggy code:
@external
def returnSome(calling: address, a: uint256) -> bool:
success: bool = false
success = raw_call(
calling,
_abi_encode(a, method_id=method_id("a(uint256)")),
revert_on_failure=False
)
any contract that uses the raw_call with revert_on_failure=False and max_outsize=0 receives the wrong response from raw_call. Depending on the memory garbage, the result can be either True or False.
Patches
Fix by @charles-cooper https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae
Workarounds
The simple workaround is always to put max_outsize>0.
Workaround example https://github.com/lidofinance/gate-seals/pull/5/files
References
Lido's fix: https://github.com/lidofinance/gate-seals/pull/5/files
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vyper"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.1"
},
{
"fixed": "0.3.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-30629"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-24T22:33:52Z",
"nvd_published_at": "2023-04-24T22:15:10Z",
"severity": "HIGH"
},
"details": "### Background\nDuring the audit of [Lido\u0027s Gate Seals](https://github.com/lidofinance/gate-seals) code [statemind](https://statemind.io) team identified a weird behavior of the code that uses `raw_call`: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 .\n\nConstruction like this:\n```vyper\nsuccess = raw_call(\n sealable,\n _abi_encode(SEAL_DURATION_SECONDS, method_id=method_id(\"pauseFor(uint256)\")),\n revert_on_failure=False\n)\n```\nwas not fully documented: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call .\n\nThe documentation says that: if `max_outsize=0` it should return nothing and then it says that if `revert_on_failure=False` it should return a `success` flag in the tuple of response, but what if `max_outsize=0` and `revert_on_failure=False`.\n\n\u003cimg width=\"715\" alt=\"image\" src=\"https://user-images.githubusercontent.com/22330612/232125364-d2b3bbac-0b4f-40cb-80ff-f55d8eafef44.png\"\u003e\n\n So the team started researching what exactly happened in that case, after some research we found that the Vyper compiler generates the wrong bytecode in that case, it generates the sequence:\n```\nCALL // call\nMLOAD // MLOAD is wrong since the CALL result is already stored in the stack\n```\n\n### Impact\nExample of buggy code:\n```vyper\n@external\ndef returnSome(calling: address, a: uint256) -\u003e bool:\n success: bool = false\n success = raw_call(\n calling,\n _abi_encode(a, method_id=method_id(\"a(uint256)\")),\n revert_on_failure=False\n )\n```\n\nany contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`.\n\n### Patches\nFix by @charles-cooper https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae\n\n### Workarounds\nThe simple workaround is always to put `max_outsize\u003e0`.\nWorkaround example https://github.com/lidofinance/gate-seals/pull/5/files\n\n### References\nLido\u0027s fix: https://github.com/lidofinance/gate-seals/pull/5/files\n",
"id": "GHSA-w9g2-3w7p-72g9",
"modified": "2024-11-19T16:31:34Z",
"published": "2023-04-24T22:33:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30629"
},
{
"type": "WEB",
"url": "https://github.com/lidofinance/gate-seals/pull/5/files"
},
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae"
},
{
"type": "WEB",
"url": "https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call"
},
{
"type": "WEB",
"url": "https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-131.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/vyperlang/vyper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Incorrect success value returned in vyper"
}
GHSA-WF42-42FG-FG84
Vulnerability from github – Published: 2026-03-17 18:38 – Updated: 2026-03-20 21:21
VLAI
Summary
Nest Fastify HEAD Request Middleware Bypass
Details
Impact
In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).
As a result:
- Middleware will be completely skipped.
- The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
- The actual handler will still be executed.
Patches
Fixed in @nestjs/platform-fastify@11.1.16
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.1.15"
},
"package": {
"ecosystem": "npm",
"name": "@nestjs/platform-fastify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.1.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33011"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-17T18:38:38Z",
"nvd_published_at": "2026-03-20T05:16:15Z",
"severity": "HIGH"
},
"details": "### Impact\n\nIn a NestJS application using `@nestjs/platform-fastify`, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).\n\nAs a result:\n\n- Middleware will be completely skipped.\n- The HTTP response won\u0027t include a body (since the response is truncated when redirecting a HEAD request to a GET handler).\n- The actual handler will still be executed.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.16`",
"id": "GHSA-wf42-42fg-fg84",
"modified": "2026-03-20T21:21:43Z",
"published": "2026-03-17T18:38:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33011"
},
{
"type": "WEB",
"url": "https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614"
},
{
"type": "PACKAGE",
"url": "https://github.com/nestjs/nest"
},
{
"type": "WEB",
"url": "https://github.com/nestjs/nest/releases/tag/v11.1.17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Nest Fastify HEAD Request Middleware Bypass"
}
GHSA-WG6C-HMH5-PHQ6
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36
VLAI
Details
MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-35477"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-18T08:15:00Z",
"severity": "MODERATE"
},
"details": "MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the \"Change visibility of selected log entries\" checkbox (or a tags checkbox) next to it, there is a redirection to the main page\u0027s action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).",
"id": "GHSA-wg6c-hmh5-phq6",
"modified": "2022-05-24T17:36:55Z",
"published": "2022-05-24T17:36:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35477"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00034.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC"
},
{
"type": "WEB",
"url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T205908"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4816"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WHVC-FHWP-5X6H
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2022-05-13 01:13
VLAI
Details
An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-19058"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-07T16:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.",
"id": "GHSA-whvc-fhwp-5x6h",
"modified": "2022-05-13T01:13:47Z",
"published": "2022-05-13T01:13:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19058"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2022"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/poppler/poppler/issues/659"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3837-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WPQR-JCPX-745R
Vulnerability from github – Published: 2022-07-05 21:06 – Updated: 2022-08-05 13:56
VLAI
Summary
Incorrect handling of invalid surrogate pair characters
Details
Impact
What kind of vulnerability is it? Who is impacted?
Anyone parsing JSON from an untrusted source is vulnerable.
JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries.
Examples:
# An unpaired high surrogate character is ignored.
>>> ujson.loads(r'"\uD800"')
''
>>> ujson.loads(r'"\uD800hello"')
'hello'
# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'
# A pair of surrogates with additional non surrogate characters pair up in spite of being invalid.
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀'
Patches
Has the problem been patched? What versions should users upgrade to?
Users should upgrade to UltraJSON 5.4.0.
From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's json module does, preserving them in the parsed output:
>>> ujson.loads(r'"\uD800"')
'\ud800'
>>> ujson.loads(r'"\uD800hello"')
'\ud800hello'
>>> ujson.loads(r'"\uDC00"')
'\udc00'
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'\ud800foo bar\udc00'
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Short of switching to an entirely different JSON library, there are no safe alternatives to upgrading.
For more information
If you have any questions or comments about this advisory: * Open an issue in UltraJSON
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ujson"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31116"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-05T21:06:00Z",
"nvd_published_at": "2022-07-05T18:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAnyone parsing JSON from an untrusted source is vulnerable.\n\nJSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries.\n\nExamples:\n\n```python\n# An unpaired high surrogate character is ignored.\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800\"\u0027)\n\u0027\u0027\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800hello\"\u0027)\n\u0027hello\u0027\n\n# An unpaired low surrogate character is preserved.\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uDC00\"\u0027)\n\u0027\\udc00\u0027\n\n# A pair of surrogates with additional non surrogate characters pair up in spite of being invalid.\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800foo bar\\uDC00\"\u0027)\n\u0027foo bar\ud800\udc00\u0027\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nUsers should upgrade to UltraJSON 5.4.0.\n\nFrom version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library\u0027s `json` module does, preserving them in the parsed output:\n\n```python3\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800\"\u0027)\n\u0027\\ud800\u0027\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800hello\"\u0027)\n\u0027\\ud800hello\u0027\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uDC00\"\u0027)\n\u0027\\udc00\u0027\n\u003e\u003e\u003e ujson.loads(r\u0027\"\\uD800foo bar\\uDC00\"\u0027)\n\u0027\\ud800foo bar\\udc00\u0027\n```\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nShort of switching to an entirely different JSON library, there are no safe alternatives to upgrading.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)\n",
"id": "GHSA-wpqr-jcpx-745r",
"modified": "2022-08-05T13:56:18Z",
"published": "2022-07-05T21:06:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ultrajson/ultrajson/security/advisories/GHSA-wpqr-jcpx-745r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31116"
},
{
"type": "WEB",
"url": "https://github.com/ultrajson/ultrajson/commit/67ec07183342589d602e0fcf7bb1ff3e19272687"
},
{
"type": "PACKAGE",
"url": "https://github.com/ultrajson/ultrajson"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NAU5N4A7EUK2AMUCOLYDD5ARXAJYZBD2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPPU5FZP3LCTXYORFH7NHUMYA5X66IA7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incorrect handling of invalid surrogate pair characters"
}
GHSA-WQ7P-5X5C-PHQR
Vulnerability from github – Published: 2023-04-20 15:30 – Updated: 2024-04-04 03:36
VLAI
Details
An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-29605"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-20T13:15:07Z",
"severity": "HIGH"
},
"details": "An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator.",
"id": "GHSA-wq7p-5x5c-phqr",
"modified": "2024-04-04T03:36:48Z",
"published": "2023-04-20T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29605"
},
{
"type": "WEB",
"url": "https://wiki.onosproject.org/display/ONOS/Intent+Framework"
},
{
"type": "WEB",
"url": "https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WV33-5PXH-R7J7
Vulnerability from github – Published: 2026-07-06 19:54 – Updated: 2026-07-06 19:54
VLAI
Summary
cut: -s (only-delimited) ignored when delimiter is a newline
Details
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
Zellic finding 3.22. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_cut"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35343"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T19:54:33Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.\n\n---\n_Zellic finding 3.22. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._",
"id": "GHSA-wv33-5pxh-r7j7",
"modified": "2026-07-06T19:54:33Z",
"published": "2026-07-06T19:54:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-wv33-5pxh-r7j7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35343"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/11143"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/9bbb58b746c41802278b0cba738eebbf21517cf7"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "cut: -s (only-delimited) ignored when delimiter is a newline"
}
GHSA-WVQ7-4F7C-Q7WC
Vulnerability from github – Published: 2026-04-02 18:31 – Updated: 2026-04-02 21:32
VLAI
Details
A bug in POST request handling causes a crash under a certain condition.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.
Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.
A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-58136"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-02T17:16:20Z",
"severity": "HIGH"
},
"details": "A bug in POST request handling causes a crash under a certain condition.\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.\n\nUsers are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.\n\nA workaround for older versions is to set\u00a0proxy.config.http.request_buffer_enabled to 0 (the default value is 0).",
"id": "GHSA-wvq7-4f7c-q7wc",
"modified": "2026-04-02T21:32:52Z",
"published": "2026-04-02T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58136"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X6QJ-75G5-46WG
Vulnerability from github – Published: 2024-11-12 18:30 – Updated: 2024-11-12 18:30
VLAI
Details
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-30133"
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T17:15:07Z",
"severity": "MODERATE"
},
"details": "HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.",
"id": "GHSA-x6qj-75g5-46wg",
"modified": "2024-11-12T18:30:57Z",
"published": "2024-11-12T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30133"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0114725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.