Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-111497 (GCVE-0-2026-111497)

Vulnerability from nvd – Published: 2026-10-22 13:35 – Updated: 2026-11-04 17:47

CISA Previdian

Title

Out-of-Bounds Write in Google Brotli Decoder

Summary

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 00:00 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-252 - Unchecked Return Value

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

22 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/october-…	patch
https://github.com/andybalholm/brotli/releases/ta…	release-notesthird-party-advisory
https://ellio.tech/en/blog/node2shell-cve-2026-11…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
http://www.openwall.com/lists/oss-security/2026/1…
https://lists.debian.org/debian-lts-announce/2026…
http://www.openwall.com/lists/oss-security/2026/10/24/6
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
https://www.aikido.dev/blog/node2shell-nodejs-bro…
https://broccoli2shell.com
https://github.com/dotnet/announcements/issues/494
https://github.com/google/brotli/releases/tag/v1.2.1
https://github.com/google/brotli/releases/tag/v1.1.1
https://github.com/google/brotli/releases/tag/v1.0.10
https://patchtheplanet.org/brotli
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/11/03/2
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

21 products

Vendor	Product	Version
Google	Brotli	Affected: 1.0.3 , < 1.0.10 (semver) Affected: 1.1.0 , < 1.1.1 (semver) Affected: 1.2.0 , < 1.2.1 (semver)
Siemens	Desigo CC family V8	Affected: 0 , < * (custom)
Siemens	Desigo CC family V9	Affected: 0 , < * (custom)
Siemens	Heliox Dual Port 60kW	Unaffected: 0 , < * (custom)
Siemens	Heliox Flex Pro	Unaffected: 0 , < * (custom)
Siemens	SICHARGE FLEX	Unaffected: 0 , < * (custom)
Siemens	SICHARGE UC	Unaffected: 0 , < * (custom)
Siemens	Sifinity Go	Unaffected: 0 , < * (custom)
Siemens	Sifinity Setup	Unaffected: 0 , < * (custom)
Siemens	VersiCharge AC Series	Unaffected: 0 , < * (custom)
Siemens	VersiCloud	Unaffected: 0 , < * (custom)
Siemens	Cloud Connector Configurator	Affected: 0 , < * (custom)
Siemens	Common Configurator (CC on IEM)	Affected: 0 , < * (custom)
Siemens	Common Configurator on Device (CC on Edge)	Affected: 0 , < * (custom)
Siemens	Data Flow Monitoring	Affected: 0 , < * (custom)
Siemens	Databus Configurator	Affected: 0 , < * (custom)
Siemens	Edge OPC UA Server Configurator	Affected: 0 , < * (custom)
Siemens	Flow Creator Configurator	Affected: 0 , < * (custom)
Siemens	Industrial Edge Hub	Affected: 0 , < * (custom)
Siemens	Industrial Edge Management Cloud	Affected: 0 , < * (custom)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Date Public

2026-02-27 07:50

Credits

OpenAI Codex Security - Khai Tran and Sylvie Mayer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111497",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T03:55:48.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:05:46.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/25"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/24/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/12"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/13"
          },
          {
            "url": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"
          },
          {
            "url": "https://broccoli2shell.com"
          },
          {
            "url": "https://github.com/dotnet/announcements/issues/494"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.2.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.1.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.0.10"
          },
          {
            "url": "https://patchtheplanet.org/brotli"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/03/2"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "Desigo CC family V8",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Desigo CC family V9",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Heliox Dual Port 60kW",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Heliox Flex Pro",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SICHARGE FLEX",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SICHARGE UC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Sifinity Go",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Sifinity Setup",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "VersiCharge AC Series",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "VersiCloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Cloud Connector Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Common Configurator\u00a0(CC on IEM)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Common Configurator on Device\u00a0(CC on Edge)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Data Flow Monitoring",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Databus Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Edge OPC UA Server Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Flow Creator Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Hub",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Cloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:47:42.136Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-898633.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-443410.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-045512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/google/brotli",
          "product": "Brotli",
          "repo": "https://github.com/google/brotli",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "1.0.10",
              "status": "affected",
              "version": "1.0.3",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.2.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI Codex Security - Khai Tran and Sylvie Mayer"
        }
      ],
      "datePublic": "2026-02-27T07:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA buffer overflow vulnerability in the Brotli decoder (\u003ccode\u003ec/dec/decode.c\u003c/code\u003e) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252 Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:58:42.704Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
        },
        {
          "tags": [
            "release-notes",
            "third-party-advisory"
          ],
          "url": "https://github.com/andybalholm/brotli/releases/tag/v1.2.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
            }
          ],
          "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Out-of-Bounds Write in Google Brotli Decoder",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-111497",
    "datePublished": "2026-10-22T13:35:41.975Z",
    "dateReserved": "2026-10-16T09:58:17.790Z",
    "dateUpdated": "2026-11-04T17:47:42.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58139 (GCVE-0-2026-58139)

Vulnerability from nvd – Published: 2026-08-03 19:45 – Updated: 2026-08-14 16:50 X_Open Source

Title

DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

Summary

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 21:07 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7416 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb-aws/pull/156	issue-tracking
https://github.com/duckdb/duckdb-aws/commit/7d041…	patch
https://www.vulncheck.com/advisories/duckdb-aws-e…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb-aws	Affected: 0 , < 7d04119ee8d3f8836e278f0e8cbf21827ff5338b (git) cpe:2.3:a:duckdb:duckdb::::::::

Date Public

2026-06-17 00:00

Credits

Mehmet Ince (@mdisec)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T21:07:40.214373Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T21:19:09.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/duckdb/duckdb",
          "product": "duckdb-aws",
          "repo": "https://github.com/duckdb/duckdb-aws",
          "vendor": "duckdb",
          "versions": [
            {
              "lessThan": "7d04119ee8d3f8836e278f0e8cbf21827ff5338b",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mehmet Ince (@mdisec)"
        }
      ],
      "datePublic": "2026-06-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:50:25.646Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/duckdb/duckdb-aws/pull/156"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/duckdb/duckdb-aws/commit/7d04119ee8d3f8836e278f0e8cbf21827ff5338b"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/duckdb-aws-extension-security-policy-bypass-via-load-aws-credentials-procedure"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58139",
    "datePublished": "2026-08-03T19:45:31.730Z",
    "dateReserved": "2026-06-29T14:13:18.385Z",
    "dateUpdated": "2026-08-14T16:50:25.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64429 (GCVE-0-2025-64429)

Vulnerability from nvd – Published: 2025-11-12 21:32 – Updated: 2025-11-13 16:45

Title

DuckDB Encryption Crypto implementation is vulnerable

Summary

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-13 16:45 UTC

CWE

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/duckdb/duckdb/security/advisor…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb/pull/17275	x_refsource_MISC
https://duckdb.org/2025/09/16/announcing-duckdb-1…	x_refsource_MISC
https://github.com/duckdb/duckdb/blob/029a5b87ff5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb	Affected: >= 1.4.0, < 1.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-13T16:45:32.309589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-13T16:45:43.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T21:32:45.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp"
        },
        {
          "name": "https://github.com/duckdb/duckdb/pull/17275",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/pull/17275"
        },
        {
          "name": "https://duckdb.org/2025/09/16/announcing-duckdb-140.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://duckdb.org/2025/09/16/announcing-duckdb-140.html"
        },
        {
          "name": "https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20"
        }
      ],
      "source": {
        "advisory": "GHSA-vmp8-hg63-v2hp",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB Encryption Crypto implementation is vulnerable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64429",
    "datePublished": "2025-11-12T21:32:45.663Z",
    "dateReserved": "2025-11-03T22:12:51.364Z",
    "dateUpdated": "2025-11-13T16:45:43.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59037 (GCVE-0-2025-59037)

Vulnerability from nvd – Published: 2025-09-09 20:26 – Updated: 2025-09-10 14:28

Title

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

Summary

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-10 14:04 UTC

CWE

CWE-506 - Embedded Malicious Code

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb-node/security/ad…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb-node/releases/ta…	x_refsource_MISC
https://www.aikido.dev/blog/npm-debug-and-chalk-p…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb-node	Affected: = 1.3.3 Affected: = 1.29.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-10T14:04:02.469534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-10T14:28:58.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb-node",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.3"
            },
            {
              "status": "affected",
              "version": "= 1.29.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB\u0027s packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-09T20:26:57.986Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c"
        },
        {
          "name": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4"
        },
        {
          "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
        }
      ],
      "source": {
        "advisory": "GHSA-w62p-hx95-gf2c",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59037",
    "datePublished": "2025-09-09T20:26:57.986Z",
    "dateReserved": "2025-09-08T16:19:26.171Z",
    "dateUpdated": "2025-09-10T14:28:58.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41672 (GCVE-0-2024-41672)

Vulnerability from nvd – Published: 2024-07-24 17:47 – Updated: 2024-08-02 04:46

Title

DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled

Summary

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-24 18:07 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb/security/advisor…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb/pull/13133	x_refsource_MISC
https://github.com/duckdb/duckdb/commit/c9b7c98aa…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
duckdb	duckdb	Affected: <= 1.0.0
duckdb	duckdb	Affected: 0 , ≤ 1.0.0 (custom) cpe:2.3:a:duckdb:duckdb::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "duckdb",
            "vendor": "duckdb",
            "versions": [
              {
                "lessThanOrEqual": "1.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41672",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T18:07:30.477604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T18:10:49.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:52.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"
          },
          {
            "name": "https://github.com/duckdb/duckdb/pull/13133",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/pull/13133"
          },
          {
            "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn\u0027t seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-24T17:47:20.626Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"
        },
        {
          "name": "https://github.com/duckdb/duckdb/pull/13133",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/pull/13133"
        },
        {
          "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"
        }
      ],
      "source": {
        "advisory": "GHSA-w2gf-jxc9-pf2q",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-41672",
    "datePublished": "2024-07-24T17:47:20.626Z",
    "dateReserved": "2024-07-18T15:21:47.486Z",
    "dateUpdated": "2024-08-02T04:46:52.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-111497 (GCVE-0-2026-111497)

Vulnerability from cvelistv5 – Published: 2026-10-22 13:35 – Updated: 2026-11-04 17:47

CISA Previdian

Title

Out-of-Bounds Write in Google Brotli Decoder

Summary

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 00:00 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-252 - Unchecked Return Value

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

22 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/october-…	patch
https://github.com/andybalholm/brotli/releases/ta…	release-notesthird-party-advisory
https://ellio.tech/en/blog/node2shell-cve-2026-11…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
http://www.openwall.com/lists/oss-security/2026/1…
https://lists.debian.org/debian-lts-announce/2026…
http://www.openwall.com/lists/oss-security/2026/10/24/6
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
https://www.aikido.dev/blog/node2shell-nodejs-bro…
https://broccoli2shell.com
https://github.com/dotnet/announcements/issues/494
https://github.com/google/brotli/releases/tag/v1.2.1
https://github.com/google/brotli/releases/tag/v1.1.1
https://github.com/google/brotli/releases/tag/v1.0.10
https://patchtheplanet.org/brotli
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/11/03/2
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

21 products

Vendor	Product	Version
Google	Brotli	Affected: 1.0.3 , < 1.0.10 (semver) Affected: 1.1.0 , < 1.1.1 (semver) Affected: 1.2.0 , < 1.2.1 (semver)
Siemens	Desigo CC family V8	Affected: 0 , < * (custom)
Siemens	Desigo CC family V9	Affected: 0 , < * (custom)
Siemens	Heliox Dual Port 60kW	Unaffected: 0 , < * (custom)
Siemens	Heliox Flex Pro	Unaffected: 0 , < * (custom)
Siemens	SICHARGE FLEX	Unaffected: 0 , < * (custom)
Siemens	SICHARGE UC	Unaffected: 0 , < * (custom)
Siemens	Sifinity Go	Unaffected: 0 , < * (custom)
Siemens	Sifinity Setup	Unaffected: 0 , < * (custom)
Siemens	VersiCharge AC Series	Unaffected: 0 , < * (custom)
Siemens	VersiCloud	Unaffected: 0 , < * (custom)
Siemens	Cloud Connector Configurator	Affected: 0 , < * (custom)
Siemens	Common Configurator (CC on IEM)	Affected: 0 , < * (custom)
Siemens	Common Configurator on Device (CC on Edge)	Affected: 0 , < * (custom)
Siemens	Data Flow Monitoring	Affected: 0 , < * (custom)
Siemens	Databus Configurator	Affected: 0 , < * (custom)
Siemens	Edge OPC UA Server Configurator	Affected: 0 , < * (custom)
Siemens	Flow Creator Configurator	Affected: 0 , < * (custom)
Siemens	Industrial Edge Hub	Affected: 0 , < * (custom)
Siemens	Industrial Edge Management Cloud	Affected: 0 , < * (custom)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Date Public

2026-02-27 07:50

Credits

OpenAI Codex Security - Khai Tran and Sylvie Mayer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111497",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T03:55:48.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:05:46.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/25"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/24/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/12"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/13"
          },
          {
            "url": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"
          },
          {
            "url": "https://broccoli2shell.com"
          },
          {
            "url": "https://github.com/dotnet/announcements/issues/494"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.2.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.1.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.0.10"
          },
          {
            "url": "https://patchtheplanet.org/brotli"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/03/2"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "Desigo CC family V8",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Desigo CC family V9",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Heliox Dual Port 60kW",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Heliox Flex Pro",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SICHARGE FLEX",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SICHARGE UC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Sifinity Go",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Sifinity Setup",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "VersiCharge AC Series",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "VersiCloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Cloud Connector Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Common Configurator\u00a0(CC on IEM)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Common Configurator on Device\u00a0(CC on Edge)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Data Flow Monitoring",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Databus Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Edge OPC UA Server Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Flow Creator Configurator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Hub",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Cloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:47:42.136Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-898633.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-443410.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-045512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/google/brotli",
          "product": "Brotli",
          "repo": "https://github.com/google/brotli",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "1.0.10",
              "status": "affected",
              "version": "1.0.3",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.2.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI Codex Security - Khai Tran and Sylvie Mayer"
        }
      ],
      "datePublic": "2026-02-27T07:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA buffer overflow vulnerability in the Brotli decoder (\u003ccode\u003ec/dec/decode.c\u003c/code\u003e) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252 Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:58:42.704Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
        },
        {
          "tags": [
            "release-notes",
            "third-party-advisory"
          ],
          "url": "https://github.com/andybalholm/brotli/releases/tag/v1.2.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
            }
          ],
          "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Out-of-Bounds Write in Google Brotli Decoder",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-111497",
    "datePublished": "2026-10-22T13:35:41.975Z",
    "dateReserved": "2026-10-16T09:58:17.790Z",
    "dateUpdated": "2026-11-04T17:47:42.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58139 (GCVE-0-2026-58139)

Vulnerability from cvelistv5 – Published: 2026-08-03 19:45 – Updated: 2026-08-14 16:50 X_Open Source

Title

DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

Summary

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 21:07 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7416 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb-aws/pull/156	issue-tracking
https://github.com/duckdb/duckdb-aws/commit/7d041…	patch
https://www.vulncheck.com/advisories/duckdb-aws-e…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb-aws	Affected: 0 , < 7d04119ee8d3f8836e278f0e8cbf21827ff5338b (git) cpe:2.3:a:duckdb:duckdb::::::::

Date Public

2026-06-17 00:00

Credits

Mehmet Ince (@mdisec)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T21:07:40.214373Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T21:19:09.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/duckdb/duckdb",
          "product": "duckdb-aws",
          "repo": "https://github.com/duckdb/duckdb-aws",
          "vendor": "duckdb",
          "versions": [
            {
              "lessThan": "7d04119ee8d3f8836e278f0e8cbf21827ff5338b",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mehmet Ince (@mdisec)"
        }
      ],
      "datePublic": "2026-06-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:50:25.646Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/duckdb/duckdb-aws/pull/156"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/duckdb/duckdb-aws/commit/7d04119ee8d3f8836e278f0e8cbf21827ff5338b"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/duckdb-aws-extension-security-policy-bypass-via-load-aws-credentials-procedure"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58139",
    "datePublished": "2026-08-03T19:45:31.730Z",
    "dateReserved": "2026-06-29T14:13:18.385Z",
    "dateUpdated": "2026-08-14T16:50:25.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64429 (GCVE-0-2025-64429)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:32 – Updated: 2025-11-13 16:45

Title

DuckDB Encryption Crypto implementation is vulnerable

Summary

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-13 16:45 UTC

CWE

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/duckdb/duckdb/security/advisor…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb/pull/17275	x_refsource_MISC
https://duckdb.org/2025/09/16/announcing-duckdb-1…	x_refsource_MISC
https://github.com/duckdb/duckdb/blob/029a5b87ff5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb	Affected: >= 1.4.0, < 1.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-13T16:45:32.309589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-13T16:45:43.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-327",
              "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T21:32:45.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp"
        },
        {
          "name": "https://github.com/duckdb/duckdb/pull/17275",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/pull/17275"
        },
        {
          "name": "https://duckdb.org/2025/09/16/announcing-duckdb-140.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://duckdb.org/2025/09/16/announcing-duckdb-140.html"
        },
        {
          "name": "https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20"
        }
      ],
      "source": {
        "advisory": "GHSA-vmp8-hg63-v2hp",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB Encryption Crypto implementation is vulnerable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64429",
    "datePublished": "2025-11-12T21:32:45.663Z",
    "dateReserved": "2025-11-03T22:12:51.364Z",
    "dateUpdated": "2025-11-13T16:45:43.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59037 (GCVE-0-2025-59037)

Vulnerability from cvelistv5 – Published: 2025-09-09 20:26 – Updated: 2025-09-10 14:28

Title

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

Summary

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-10 14:04 UTC

CWE

CWE-506 - Embedded Malicious Code

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb-node/security/ad…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb-node/releases/ta…	x_refsource_MISC
https://www.aikido.dev/blog/npm-debug-and-chalk-p…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
duckdb	duckdb-node	Affected: = 1.3.3 Affected: = 1.29.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-10T14:04:02.469534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-10T14:28:58.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb-node",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.3"
            },
            {
              "status": "affected",
              "version": "= 1.29.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB\u0027s packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-09T20:26:57.986Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c"
        },
        {
          "name": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb-node/releases/tag/v1.3.4"
        },
        {
          "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
        }
      ],
      "source": {
        "advisory": "GHSA-w62p-hx95-gf2c",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59037",
    "datePublished": "2025-09-09T20:26:57.986Z",
    "dateReserved": "2025-09-08T16:19:26.171Z",
    "dateUpdated": "2025-09-10T14:28:58.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-41672 (GCVE-0-2024-41672)

Vulnerability from cvelistv5 – Published: 2024-07-24 17:47 – Updated: 2024-08-02 04:46

Title

DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled

Summary

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-24 18:07 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7917 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/duckdb/duckdb/security/advisor…	x_refsource_CONFIRM
https://github.com/duckdb/duckdb/pull/13133	x_refsource_MISC
https://github.com/duckdb/duckdb/commit/c9b7c98aa…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
duckdb	duckdb	Affected: <= 1.0.0
duckdb	duckdb	Affected: 0 , ≤ 1.0.0 (custom) cpe:2.3:a:duckdb:duckdb::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "duckdb",
            "vendor": "duckdb",
            "versions": [
              {
                "lessThanOrEqual": "1.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41672",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T18:07:30.477604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T18:10:49.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:52.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"
          },
          {
            "name": "https://github.com/duckdb/duckdb/pull/13133",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/pull/13133"
          },
          {
            "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "duckdb",
          "vendor": "duckdb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn\u0027t seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-24T17:47:20.626Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"
        },
        {
          "name": "https://github.com/duckdb/duckdb/pull/13133",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/pull/13133"
        },
        {
          "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"
        }
      ],
      "source": {
        "advisory": "GHSA-w2gf-jxc9-pf2q",
        "discovery": "UNKNOWN"
      },
      "title": "DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-41672",
    "datePublished": "2024-07-24T17:47:20.626Z",
    "dateReserved": "2024-07-18T15:21:47.486Z",
    "dateUpdated": "2024-08-02T04:46:52.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

10 vulnerabilities by duckdb

CVE-2026-111497 (GCVE-0-2026-111497)

CVE-2026-58139 (GCVE-0-2026-58139)

CVE-2025-64429 (GCVE-0-2025-64429)

CVE-2025-59037 (GCVE-0-2025-59037)

CVE-2024-41672 (GCVE-0-2024-41672)

CVE-2026-111497 (GCVE-0-2026-111497)

CVE-2026-58139 (GCVE-0-2026-58139)

CVE-2025-64429 (GCVE-0-2025-64429)

CVE-2025-59037 (GCVE-0-2025-59037)

CVE-2024-41672 (GCVE-0-2024-41672)