Common Weakness Enumeration

CWE-670

Allowed-with-Review

Always-Incorrect Control Flow Implementation

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

229 vulnerabilities reference this CWE, most recent first.

CVE-2026-32713 (GCVE-0-2026-32713)

Vulnerability from cvelistv5 – Published: 2026-03-13 21:20 – Updated: 2026-03-17 15:11
VLAI
Title
PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors
Summary
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2.
Severity
4.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-17 15:10 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7637 records in the last 180 days details
References
Impacted products
Vendor Product Version
PX4 PX4-Autopilot Affected: < 1.17.0-rc2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32713",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T15:10:37.135599Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T15:11:04.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PX4-Autopilot",
          "vendor": "PX4",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.0-rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (\u0026\u0026 instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670: Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T21:20:09.352Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m"
        }
      ],
      "source": {
        "advisory": "GHSA-pp2c-jr5g-6f2m",
        "discovery": "UNKNOWN"
      },
      "title": "PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32713",
    "datePublished": "2026-03-13T21:20:09.352Z",
    "dateReserved": "2026-03-13T14:33:42.824Z",
    "dateUpdated": "2026-03-17T15:11:04.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26267 (GCVE-0-2026-26267)

Vulnerability from cvelistv5 – Published: 2026-02-19 19:35 – Updated: 2026-02-19 21:22
VLAI
Title
rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
Summary
soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it's processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function. This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously: First, an `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied. Second, an `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied. If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function. The problem is patched in `soroban-sdk-macros` versions 22.0.10, 23.5.2, and 25.1.1. The fix changes the generated call from `<Type>::func()` to `<Type as Trait>::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists. Users should upgrade to `soroban-sdk-macros` 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts. If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-19 20:58 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7637 records in the last 180 days details
References
Impacted products
Vendor Product Version
stellar rs-soroban-sdk Affected: >= 25.0.0, < 25.1.1
Affected: >= 23.0.0, < 23.5.2
Affected: < 22.0.10
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T20:58:43.298688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T21:22:10.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rs-soroban-sdk",
          "vendor": "stellar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 25.0.0, \u003c 25.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0, \u003c 23.5.2"
            },
            {
              "status": "affected",
              "version": "\u003c 22.0.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it\u0027s processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function. This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously: First, an `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied. Second, an `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied. If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function. The problem is patched in `soroban-sdk-macros` versions 22.0.10, 23.5.2, and 25.1.1. The fix changes the generated call from `\u003cType\u003e::func()` to `\u003cType as Trait\u003e::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists. Users should upgrade to `soroban-sdk-macros` 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts. If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670: Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T19:35:40.539Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254"
        },
        {
          "name": "https://github.com/stellar/rs-soroban-sdk/pull/1729",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-soroban-sdk/pull/1729"
        },
        {
          "name": "https://github.com/stellar/rs-soroban-sdk/pull/1730",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-soroban-sdk/pull/1730"
        },
        {
          "name": "https://github.com/stellar/rs-soroban-sdk/pull/1731",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-soroban-sdk/pull/1731"
        },
        {
          "name": "https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b"
        }
      ],
      "source": {
        "advisory": "GHSA-4chv-4c6w-w254",
        "discovery": "UNKNOWN"
      },
      "title": "rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26267",
    "datePublished": "2026-02-19T19:35:40.539Z",
    "dateReserved": "2026-02-12T17:10:53.412Z",
    "dateUpdated": "2026-02-19T21:22:10.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20713 (GCVE-0-2026-20713)

Vulnerability from cvelistv5 – Published: 2026-08-11 16:25 – Updated: 2026-08-12 15:51
VLAI
Summary
Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
Severity
4.5 (Medium)
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 15:51 UTC
CWE
  • Escalation of Privilege
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
intel CNA under the mitre root
CNA scorecard C 60/100 over 96 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T15:51:26.872676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-670",
                "description": "CWE-670 Always-Incorrect Control Flow Implementation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T15:51:47.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en"
            },
            {
              "cweId": "CWE-670",
              "description": "Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T16:25:23.498Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html",
          "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2026-20713",
    "datePublished": "2026-08-11T16:25:23.498Z",
    "dateReserved": "2025-12-09T04:00:18.710Z",
    "dateUpdated": "2026-08-12T15:51:47.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1-2026-20250 (CVE-2026-92932)

Vulnerability from gna-1 – Published: 2026-09-17 12:31 – Updated: 2026-09-17 12:40
VLAI
Title
MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
Summary
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
CIRCL GNA GNA-1
GNA scorecard B 90/100 over 243 records in the last 180 days details
References
Impacted products
Vendor Product Version
misp sachertortephp Affected: 0 , < 1c2da20cbe3f1e2a91458fe9a017823b7273fdac (semver)
Create a notification for this product.
Credits
iglocska iglocska
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-17 12:27
Model
qwen3.8:27b
Input
https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch a5f13eb5fbce…
Confidence
medium
Commit Subject Patch SHA-256
1c2da20cbe3f fix: [security] Gate the https branch of Xml::build() on a5f13eb5fbce…
Fix summary

The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options['readFile'] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller's intended control over remote reads and eliminating the SSRF vector.

Patch summary

In lib/Cake/Utility/Xml.php, line 110, the condition $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0 is changed to $options['readFile'] && (strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the &&, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.

CVSS rationale

AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application's own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system's confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.

Weakness rationale
  • CWE-918 The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets.
  • CWE-670 The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF.
Attack pattern rationale
  • CAPEC-66 The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL.
Assumptions to verify
  • PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.
  • The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.
  • The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.
  • The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.
  • The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 medium 5
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "lib/Cake/Utility/Xml.php"
          ],
          "product": "sachertortephp",
          "programFiles": [
            "lib/Cake/Utility/Xml.php"
          ],
          "repo": "https://github.com/MISP/sachertortephp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026amp;\u0026amp; operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\u003c/p\u003e"
            }
          ],
          "value": "In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026\u0026 operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.",
                  "The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.",
                  "The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.",
                  "The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.",
                  "The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL."
                  }
                ],
                "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system\u0027s confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.",
                "fixSummary": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.",
                "generatedAt": "2026-09-17T12:27:24.482336Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                "patchSummary": "In lib/Cake/Utility/Xml.php, line 110, the condition $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0 is changed to $options[\u0027readFile\u0027] \u0026\u0026 (strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the \u0026\u0026, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                    "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                    "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "sourceUrl": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "subject": "fix: [security] Gate the https branch of Xml::build() on"
                  }
                ],
                "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                "subject": "fix: [security] Gate the https branch of Xml::build() on",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets."
                  },
                  {
                    "cweId": "CWE-670",
                    "rationale": "The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20250"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-92932",
    "datePublished": "2026-09-17T12:31:00.000Z",
    "dateReserved": "2026-09-17T12:33:00.000Z",
    "dateUpdated": "2026-09-17T12:40:24.560833Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20250"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-20171 (GCVE-0-2026-20171)

Vulnerability from cvelistv5 – Published: 2026-05-20 16:06 – Updated: 2026-05-20 18:31
VLAI
Title
Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability
Summary
A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition.
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 18:31 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
cisco CNA under the mitre root
CNA scorecard C 66/100 over 377 records in the last 180 days details
References
Impacted products
Vendor Product Version
Cisco Cisco NX-OS Software Affected: 10.2(1)
Affected: 10.2(1q)
Affected: 10.2(2)
Affected: 10.2(3)
Affected: 10.2(3t)
Affected: 10.2(2a)
Affected: 10.3(1)
Affected: 10.2(4)
Affected: 10.3(2)
Affected: 10.3(3)
Affected: 10.2(5)
Affected: 10.2(3v)
Affected: 10.4(1)
Affected: 10.3(99w)
Affected: 10.2(6)
Affected: 10.3(3w)
Affected: 10.3(99x)
Affected: 10.3(3o)
Affected: 10.3(4)
Affected: 10.3(3p)
Affected: 10.3(4a)
Affected: 10.4(2)
Affected: 10.3(3q)
Affected: 10.3(5)
Affected: 10.2(7)
Affected: 10.4(3)
Affected: 10.3(3x)
Affected: 10.3(4g)
Affected: 10.5(1)
Affected: 10.2(8)
Affected: 10.3(3r)
Affected: 10.3(6)
Affected: 10.4(4)
Affected: 10.3(4h)
Affected: 10.5(2)
Affected: 10.3(7)
Affected: 10.4(5)
Affected: 10.5(3)
Affected: 10.2(9)
Affected: 10.4(4g)
Affected: 10.6(1)
Affected: 10.5(3t)
Affected: 10.3(8)
Affected: 10.4(6)
Affected: 10.5(3s)
Affected: 10.5(3e)
Affected: 10.5(3o)
Affected: 10.6(1s)
Affected: 10.5(3p)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T18:31:37.215391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T18:31:44.204Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco NX-OS Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "10.2(1)"
            },
            {
              "status": "affected",
              "version": "10.2(1q)"
            },
            {
              "status": "affected",
              "version": "10.2(2)"
            },
            {
              "status": "affected",
              "version": "10.2(3)"
            },
            {
              "status": "affected",
              "version": "10.2(3t)"
            },
            {
              "status": "affected",
              "version": "10.2(2a)"
            },
            {
              "status": "affected",
              "version": "10.3(1)"
            },
            {
              "status": "affected",
              "version": "10.2(4)"
            },
            {
              "status": "affected",
              "version": "10.3(2)"
            },
            {
              "status": "affected",
              "version": "10.3(3)"
            },
            {
              "status": "affected",
              "version": "10.2(5)"
            },
            {
              "status": "affected",
              "version": "10.2(3v)"
            },
            {
              "status": "affected",
              "version": "10.4(1)"
            },
            {
              "status": "affected",
              "version": "10.3(99w)"
            },
            {
              "status": "affected",
              "version": "10.2(6)"
            },
            {
              "status": "affected",
              "version": "10.3(3w)"
            },
            {
              "status": "affected",
              "version": "10.3(99x)"
            },
            {
              "status": "affected",
              "version": "10.3(3o)"
            },
            {
              "status": "affected",
              "version": "10.3(4)"
            },
            {
              "status": "affected",
              "version": "10.3(3p)"
            },
            {
              "status": "affected",
              "version": "10.3(4a)"
            },
            {
              "status": "affected",
              "version": "10.4(2)"
            },
            {
              "status": "affected",
              "version": "10.3(3q)"
            },
            {
              "status": "affected",
              "version": "10.3(5)"
            },
            {
              "status": "affected",
              "version": "10.2(7)"
            },
            {
              "status": "affected",
              "version": "10.4(3)"
            },
            {
              "status": "affected",
              "version": "10.3(3x)"
            },
            {
              "status": "affected",
              "version": "10.3(4g)"
            },
            {
              "status": "affected",
              "version": "10.5(1)"
            },
            {
              "status": "affected",
              "version": "10.2(8)"
            },
            {
              "status": "affected",
              "version": "10.3(3r)"
            },
            {
              "status": "affected",
              "version": "10.3(6)"
            },
            {
              "status": "affected",
              "version": "10.4(4)"
            },
            {
              "status": "affected",
              "version": "10.3(4h)"
            },
            {
              "status": "affected",
              "version": "10.5(2)"
            },
            {
              "status": "affected",
              "version": "10.3(7)"
            },
            {
              "status": "affected",
              "version": "10.4(5)"
            },
            {
              "status": "affected",
              "version": "10.5(3)"
            },
            {
              "status": "affected",
              "version": "10.2(9)"
            },
            {
              "status": "affected",
              "version": "10.4(4g)"
            },
            {
              "status": "affected",
              "version": "10.6(1)"
            },
            {
              "status": "affected",
              "version": "10.5(3t)"
            },
            {
              "status": "affected",
              "version": "10.3(8)"
            },
            {
              "status": "affected",
              "version": "10.4(6)"
            },
            {
              "status": "affected",
              "version": "10.5(3s)"
            },
            {
              "status": "affected",
              "version": "10.5(3e)"
            },
            {
              "status": "affected",
              "version": "10.5(3o)"
            },
            {
              "status": "affected",
              "version": "10.6(1s)"
            },
            {
              "status": "affected",
              "version": "10.5(3p)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Border Gateway Protocol (BGP)\u0026nbsp;enforce-first-as feature of\u0026nbsp;Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T16:06:38.711Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-bgp-iefab-3hb2pwtx",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgp-iefab-3hb2pwtx"
        }
      ],
      "source": {
        "advisory": "cisco-sa-bgp-iefab-3hb2pwtx",
        "defects": [
          "CSCwr23951"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20171",
    "datePublished": "2026-05-20T16:06:38.711Z",
    "dateReserved": "2025-10-08T11:59:15.391Z",
    "dateUpdated": "2026-05-20T18:31:44.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19487 (GCVE-0-2026-19487)

Vulnerability from cvelistv5 – Published: 2026-08-13 15:51 – Updated: 2026-08-13 20:12
VLAI
Title
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Summary
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:47 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 64/100 over 265 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 5.9.4 , < 5.41.9 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-19487",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:47:48.584748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:48:30.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Perl/perl5/issues/22892"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-13T20:12:11.045Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/13/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "perl"
          ],
          "packageName": "perl",
          "packageURL": "pkg:cpan/perl",
          "programFiles": [
            "regexec.c"
          ],
          "programRoutines": [
            {
              "name": "S_find_byclass"
            }
          ],
          "repo": "https://github.com/Perl/perl5",
          "versions": [
            {
              "lessThan": "5.41.9",
              "status": "affected",
              "version": "5.9.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T15:51:04.090Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/Perl/perl5/issues/22892"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Perl 5.42.0 or later, or apply the upstream patch."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-19487",
    "datePublished": "2026-08-13T15:51:04.090Z",
    "dateReserved": "2026-08-10T16:35:50.763Z",
    "dateUpdated": "2026-08-13T20:12:11.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14935 (GCVE-0-2026-14935)

Vulnerability from cvelistv5 – Published: 2026-07-07 15:37 – Updated: 2026-09-10 17:27
VLAI
Title
Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
Summary
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-07 16:13 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
redhat CNA under the redhat root
CNA scorecard B 81/100 over 1011 records in the last 180 days details
References
Impacted products
Date Public
2026-07-07 15:25
Credits
Red Hat would like to thank Clouditera Security (Clouditera), NSFOCUS (NSFOCUS), and Z.ai Security (Z.ai) for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14935",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T16:13:21.634704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T16:13:27.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-bad-free",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Clouditera Security (Clouditera), NSFOCUS (NSFOCUS), and Z.ai Security (Z.ai) for reporting this issue."
        }
      ],
      "datePublic": "2026-07-07T15:25:24.763Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic vulnerability was found in GStreamer\u0027s webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T17:27:23.306Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-14935"
        },
        {
          "name": "RHBZ#2497679",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497679"
        },
        {
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98"
        },
        {
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5171"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-07T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-07T15:25:24.763Z",
          "value": "Made public."
        }
      ],
      "title": "Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. Ensure WebRTC signaling channels use TLS encryption to prevent SDP modification in transit.\n2. If WebRTC functionality is not required, remove the webrtcbin plugin shared object from the GStreamer plugins directory (typically /usr/lib64/gstreamer-1.0/libgstwebrtc.so)."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-670: Always-Incorrect Control Flow Implementation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-14935",
    "datePublished": "2026-07-07T15:37:58.898Z",
    "dateReserved": "2026-07-07T11:25:35.489Z",
    "dateUpdated": "2026-09-10T17:27:23.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-7656 (GCVE-0-2026-7656)

Vulnerability from cvelistv5 – Published: 2026-06-29 22:09 – Updated: 2026-08-06 20:20
VLAI
Title
Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack
Summary
The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was ((length/hop/source/target checks) && (icmp_hdr->code != 0)). Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker — and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated length is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-30 13:10 UTC
CWE
Assigner
zephyr CNA under the mitre root
CNA scorecard B 77/100 over 175 records in the last 180 days details
References
Impacted products
Vendor Product Version
zephyrproject zephyr Affected: 1.14.0 , < 4.5.0 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7656",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:10:33.227842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:11:01.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cpjw-rvwx-ph9f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/net/ip/ipv6_nbr.c"
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was ((length/hop/source/target checks) \u0026\u0026 (icmp_hdr-\u003ecode != 0)). Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker \u2014 and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected \u2014 can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim\u0027s default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated length is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "input-validation",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-670",
              "description": "input-validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T20:20:15.883Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/095f064c94b95f9c35e05602e693dc268f0cb865"
        },
        {
          "name": "GHSA-cpjw-rvwx-ph9f",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cpjw-rvwx-ph9f"
        }
      ],
      "title": "Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-7656",
    "datePublished": "2026-06-29T22:09:10.460Z",
    "dateReserved": "2026-05-01T18:40:20.792Z",
    "dateUpdated": "2026-08-06T20:20:15.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6608 (GCVE-0-2026-6608)

Vulnerability from cvelistv5 – Published: 2026-04-20 05:15 – Updated: 2026-04-20 14:57
VLAI
Title
lm-sys fastchat Arena Side-by-Side View add_text control flow
Summary
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-20 14:57 UTC
CWE
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3880 records in the last 180 days details
References
Impacted products
Vendor Product Version
lm-sys fastchat Affected: 0.2.0
Affected: 0.2.1
Affected: 0.2.2
Affected: 0.2.3
Affected: 0.2.4
Affected: 0.2.5
Affected: 0.2.6
Affected: 0.2.7
Affected: 0.2.8
Affected: 0.2.9
Affected: 0.2.10
Affected: 0.2.11
Affected: 0.2.12
Affected: 0.2.13
Affected: 0.2.14
Affected: 0.2.15
Affected: 0.2.16
Affected: 0.2.17
Affected: 0.2.18
Affected: 0.2.19
Affected: 0.2.20
Affected: 0.2.21
Affected: 0.2.22
Affected: 0.2.23
Affected: 0.2.24
Affected: 0.2.25
Affected: 0.2.26
Affected: 0.2.27
Affected: 0.2.28
Affected: 0.2.29
Affected: 0.2.30
Affected: 0.2.31
Affected: 0.2.32
Affected: 0.2.33
Affected: 0.2.34
Affected: 0.2.35
Affected: 0.2.36
    cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Eric-f (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6608",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-20T14:57:43.886595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T14:57:55.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Arena Side-by-Side View Handler"
          ],
          "product": "fastchat",
          "vendor": "lm-sys",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.0"
            },
            {
              "status": "affected",
              "version": "0.2.1"
            },
            {
              "status": "affected",
              "version": "0.2.2"
            },
            {
              "status": "affected",
              "version": "0.2.3"
            },
            {
              "status": "affected",
              "version": "0.2.4"
            },
            {
              "status": "affected",
              "version": "0.2.5"
            },
            {
              "status": "affected",
              "version": "0.2.6"
            },
            {
              "status": "affected",
              "version": "0.2.7"
            },
            {
              "status": "affected",
              "version": "0.2.8"
            },
            {
              "status": "affected",
              "version": "0.2.9"
            },
            {
              "status": "affected",
              "version": "0.2.10"
            },
            {
              "status": "affected",
              "version": "0.2.11"
            },
            {
              "status": "affected",
              "version": "0.2.12"
            },
            {
              "status": "affected",
              "version": "0.2.13"
            },
            {
              "status": "affected",
              "version": "0.2.14"
            },
            {
              "status": "affected",
              "version": "0.2.15"
            },
            {
              "status": "affected",
              "version": "0.2.16"
            },
            {
              "status": "affected",
              "version": "0.2.17"
            },
            {
              "status": "affected",
              "version": "0.2.18"
            },
            {
              "status": "affected",
              "version": "0.2.19"
            },
            {
              "status": "affected",
              "version": "0.2.20"
            },
            {
              "status": "affected",
              "version": "0.2.21"
            },
            {
              "status": "affected",
              "version": "0.2.22"
            },
            {
              "status": "affected",
              "version": "0.2.23"
            },
            {
              "status": "affected",
              "version": "0.2.24"
            },
            {
              "status": "affected",
              "version": "0.2.25"
            },
            {
              "status": "affected",
              "version": "0.2.26"
            },
            {
              "status": "affected",
              "version": "0.2.27"
            },
            {
              "status": "affected",
              "version": "0.2.28"
            },
            {
              "status": "affected",
              "version": "0.2.29"
            },
            {
              "status": "affected",
              "version": "0.2.30"
            },
            {
              "status": "affected",
              "version": "0.2.31"
            },
            {
              "status": "affected",
              "version": "0.2.32"
            },
            {
              "status": "affected",
              "version": "0.2.33"
            },
            {
              "status": "affected",
              "version": "0.2.34"
            },
            {
              "status": "affected",
              "version": "0.2.35"
            },
            {
              "status": "affected",
              "version": "0.2.36"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric-f (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "Incorrect Control Flow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-20T05:15:12.337Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-358243 | lm-sys fastchat Arena Side-by-Side View add_text control flow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/358243"
        },
        {
          "name": "VDB-358243 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/358243/cti"
        },
        {
          "name": "Submit #792228 | LM-Sys FastChat \u003c= 0.2.36 Content Moderation Bypass (CWE-670)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/792228"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/lm-sys/FastChat/issues/3834"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/YLChen-007/e45039d23e698222d887ee09735d9d36"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/lm-sys/FastChat/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-04-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-04-19T18:04:52.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "lm-sys fastchat Arena Side-by-Side View add_text control flow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-6608",
    "datePublished": "2026-04-20T05:15:12.337Z",
    "dateReserved": "2026-04-19T15:59:43.122Z",
    "dateUpdated": "2026-04-20T14:57:55.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1874 (GCVE-0-2026-1874)

Vulnerability from cvelistv5 – Published: 2026-03-03 06:46 – Updated: 2026-04-24 07:24
VLAI
Title
Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module
Summary
Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-03 14:35 UTC
CWE
  • CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
Mitsubishi CNA under the jpcert root
CNA scorecard – unranked: 5 records in the last 180 days, 10 needed details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1874",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T14:35:32.565171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T14:35:41.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP",
          "vendor": "Mitsubishi Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.106 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP",
          "vendor": "Mitsubishi Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.000 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery."
            }
          ],
          "value": "Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial-of-Service"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T07:24:38.061Z",
        "orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
        "shortName": "Mitsubishi"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-021_en.pdf"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://jvn.jp/vu/JVNVU93286687/"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-62-01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
    "assignerShortName": "Mitsubishi",
    "cveId": "CVE-2026-1874",
    "datePublished": "2026-03-03T06:46:21.526Z",
    "dateReserved": "2026-02-04T04:08:41.166Z",
    "dateUpdated": "2026-04-24T07:24:38.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list