Common Weakness Enumeration
CWE-1284
AllowedImproper Validation of Specified Quantity in Input
Abstraction: Base · Status: Incomplete
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
316 vulnerabilities reference this CWE, most recent first.
CVE-2026-114349 (GCVE-0-2026-114349)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:46 – Updated: 2026-11-05 17:28
VLAI
EPSS
VEX
Title
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Summary
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size.
Impact:
An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:28 UTC
CWE
Assigner
apache
CNA
References
3 references
| URL | Tags |
|---|---|
| https://kafka.apache.org/cve-list | vendor-advisory |
| https://lists.apache.org/thread/hdy56hrd1h9btf30j… | mailing-list |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 2.5.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
0.11.0.0 , < 4.0.0
(maven)
|
|
| Apache Software Foundation | Apache Kafka |
Affected:
2.4.0 , ≤ 4.1.2
(maven)
Affected: 4.2.0 , ≤ 4.2.1 (maven) Affected: 4.3.0 , ≤ 4.3.1 (maven) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-28T20:06:58.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-114349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:28:36.990519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:28:41.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.11",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.11",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.5.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.12",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.12",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.0.0",
"status": "affected",
"version": "0.11.0.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.kafka:kafka_2.13",
"packageURL": "pkg:maven/org.apache.kafka/kafka_2.13",
"product": "Apache Kafka",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.1.2",
"status": "affected",
"version": "2.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.2.1",
"status": "affected",
"version": "4.2.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "4.3.1",
"status": "affected",
"version": "4.3.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peyton Kennedy \u003cpkennedy@endor.ai\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Trung Nguyen \u003ctrungnh@cystack.net\u003e, CyStack"
},
{
"lang": "en",
"type": "reporter",
"value": "Bart\u0142omiej Dmitruk \u003cbartek@striga.ai\u003e, Striga"
},
{
"lang": "en",
"type": "reporter",
"value": "\uc784\uc131\ubbfc \u003cat_haemil@naver.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Mike Read (GitHub: Michael-JRead)"
},
{
"lang": "en",
"type": "reporter",
"value": "Salman Aljardan \u003csalman1aljardan@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yuchao Zhang \u003cndaugoing@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao \u003cyubao@paypal.com\u003e, PayPal Cyber Security Team"
},
{
"lang": "en",
"type": "reporter",
"value": "Vamsi K \u003cxh081ix@gmail.com\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Srinivas Akhil Mallela \u003csrinivasakhil@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "Ashish Modi, OpenLogic by Perforce"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cbr\u003e\u003cdiv\u003eWhen a broker decodes a compressed record batch, the per-record decoder reads a declared body\u0026nbsp;\u003cspan\u003esize from the decompressed stream and allocates a buffer of that size before validating it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eagainst the bytes available or any configured limit. The size is attacker-controlled, and the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebatch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u0026nbsp;\u003c/span\u003e\u003cspan\u003erequest can declare a body size of up to about 2 GiB and force the broker to attempt that\u0026nbsp;\u003c/span\u003e\u003cspan\u003eallocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u0026nbsp;\u003c/span\u003e\u003cspan\u003esize limit, and client/broker quotas bound only the compressed wire size, not the declared\u0026nbsp;\u003c/span\u003e\u003cspan\u003edecompressed size.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eImpact:\u003c/div\u003e\u003cdiv\u003eAn authenticated principal with Write on a topic can crash broker request-handler threads\u0026nbsp;\u003cspan\u003e(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u0026nbsp;\u003c/span\u003e\u003cspan\u003ere-encoded) and any consumer that fetches the record, denying service. On brokers started\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebroker JVM. More seriously, a\u0026nbsp;crafted record\u0026nbsp;\u0026nbsp;\u003c/span\u003e\u003cspan\u003eis accepted at ingest and written to disk; when the log-cleaner later reads it\u0026nbsp;\u003c/span\u003e\u003cspan\u003eon a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethread, which is not restarted. With the default of a single cleaner thread, log compaction\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethen stops for the entire broker, including the internal __consumer_offsets and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e__transaction_state topics, and the condition persists across restarts until the offending\u0026nbsp;\u003c/span\u003e\u003cspan\u003erecord is removed. The impact is availability only; no data is disclosed or altered.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003c/div\u003e\u003cdiv\u003eUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u0026nbsp;\u003cspan\u003ebroker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u0026nbsp;\u003c/span\u003e\u003cspan\u003enot sufficient: for backward compatibility this configuration defaults to an effectively\u0026nbsp;\u003c/span\u003e\u003cspan\u003eunlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u0026nbsp;\u003c/span\u003e\u003cspan\u003evalue at or slightly above the largest legitimate decompressed record your applications\u0026nbsp;\u003c/span\u003e\u003cspan\u003eproduce, and comfortably below the broker heap divided by the number of request-handler and\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u0026nbsp;\u003c/span\u003e\u003cspan\u003etrusted producers; quotas and max.message.bytes do not mitigate this issue.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eResolution:\u003c/div\u003e\u003cdiv\u003eFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u0026nbsp;\u003cspan\u003ebody size against max.decompressed.message.bytes before allocating, on the produce-validation,\u0026nbsp;\u003c/span\u003e\u003cspan\u003elog-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u0026nbsp;\u003c/span\u003e\u003cspan\u003eInvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u0026nbsp;\u003c/span\u003e\u003cspan\u003eas its default is effectively unlimited.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "When a broker decodes a compressed record batch, the per-record decoder reads a declared body\u00a0size from the decompressed stream and allocates a buffer of that size before validating it\u00a0against the bytes available or any configured limit. The size is attacker-controlled, and the\u00a0batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce\u00a0request can declare a body size of up to about 2 GiB and force the broker to attempt that\u00a0allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request\u00a0size limit, and client/broker quotas bound only the compressed wire size, not the declared\u00a0decompressed size.\n\n\nImpact:\n\nAn authenticated principal with Write on a topic can crash broker request-handler threads\u00a0(reached when a batch\u0027s codec differs from the topic\u0027s compression.type and records are\u00a0re-encoded) and any consumer that fetches the record, denying service. On brokers started\u00a0with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the\u00a0broker JVM. More seriously, a\u00a0crafted record\u00a0\u00a0is accepted at ingest and written to disk; when the log-cleaner later reads it\u00a0on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner\u00a0thread, which is not restarted. With the default of a single cleaner thread, log compaction\u00a0then stops for the entire broker, including the internal __consumer_offsets and\u00a0__transaction_state topics, and the condition persists across restarts until the offending\u00a0record is removed. The impact is availability only; no data is disclosed or altered.\n\n\nMitigation:\n\nUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the\u00a0broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is\u00a0not sufficient: for backward compatibility this configuration defaults to an effectively\u00a0unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a\u00a0value at or slightly above the largest legitimate decompressed record your applications\u00a0produce, and comfortably below the broker heap divided by the number of request-handler and\u00a0cleaner threads. Until you can upgrade and configure the limit, restrict Write access to\u00a0trusted producers; quotas and max.message.bytes do not mitigate this issue.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record\u0027s declared decompressed\u00a0body size against max.decompressed.message.bytes before allocating, on the produce-validation,\u00a0log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with\u00a0InvalidRecordException. Operators must set this configuration to a bounded value to be protected,\u00a0as its default is effectively unlimited."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper validation of specified quantity in input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:48:26.738Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://kafka.apache.org/cve-list"
},
{
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread/hdy56hrd1h9btf30jb1noswsx32l17dq"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114349",
"datePublished": "2026-10-28T16:46:54.920Z",
"dateReserved": "2026-10-21T08:14:55.090Z",
"dateUpdated": "2026-11-05T17:28:41.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112112 (GCVE-0-2026-112112)
Vulnerability from cvelistv5 – Published: 2026-10-18 23:01 – Updated: 2026-10-19 18:41
VLAI
EPSS
VEX
Summary
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:39 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
mitre
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112112",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:39:04.870755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:41:47.949Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"IPv6 FlowSpec validation"
],
"product": "BIRD",
"programFiles": [
"nest/rt-table.c"
],
"programRoutines": [
{
"name": "net_flow_has_dst_prefix"
}
],
"repo": "https://gitlab.nic.cz/labs/bird",
"vendor": "nic",
"versions": [
{
"lessThanOrEqual": "2.20.0",
"status": "affected",
"version": "2.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.4.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action.\u003c/p\u003e"
}
],
"value": "An established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.20.0",
"versionStartIncluding": "2.0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.4.0",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T23:01:05.633Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc"
},
{
"url": "https://www.rfc-editor.org/rfc/rfc8956.html#section-5"
},
{
"url": "https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"
},
{
"url": "https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified.\u003c/p\u003e"
}
],
"value": "Apply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified."
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-112112",
"datePublished": "2026-10-18T23:01:05.633Z",
"dateReserved": "2026-10-18T23:01:05.103Z",
"dateUpdated": "2026-10-19T18:41:47.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111828 (GCVE-0-2026-111828)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:29 – Updated: 2026-10-19 18:13 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
Summary
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:12 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mamunur Rashid | Classified Listing |
Affected:
0 , ≤ 6.1.5
(custom)
|
Date Public
2026-10-19 13:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:12:52.819494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:13:06.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "classified-listing",
"product": "Classified Listing",
"vendor": "Mamunur Rashid",
"versions": [
{
"changes": [
{
"at": "6.2.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.1.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "changsheng | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-19T13:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects Classified Listing: from n/a through 6.1.5.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:30:02.944Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-6-1-5-direct-static-code-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Classified Listing plugin to the latest available version (at least 6.2.0)."
}
],
"value": "Update the WordPress Classified Listing plugin to the latest available version (at least 6.2.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Classified Listing plugin \u003c= 6.1.5 - Direct static code injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-111828",
"datePublished": "2026-10-19T13:29:02.276Z",
"dateReserved": "2026-10-17T00:17:57.460Z",
"dateUpdated": "2026-10-19T18:13:06.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109821 (GCVE-0-2026-109821)
Vulnerability from cvelistv5 – Published: 2026-10-30 08:54 – Updated: 2026-10-30 16:52
VLAI
EPSS
VEX
Title
Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
Summary
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.
URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.
This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:52 UTC
CWE
Assigner
EEF
CNA
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
0.5.0 , < 1.18.6
(semver)
Affected: 1.19.0-rc.0 , < 1.19.7 (semver) Affected: 1.20.0-rc.0 , < 1.20.5 (semver) cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
39801821eef2d06524e5ebf5a0e4b3c380ad23ae , < *
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
Date Public
2026-10-30 08:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109821",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:52:15.736711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:52:43.052Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.URI\u0027",
"\u0027Elixir.String.Chars.URI\u0027"
],
"packageName": "elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/uri.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.URI\u0027:parse/1"
},
{
"name": "\u0027Elixir.URI\u0027:split_authority/1"
},
{
"name": "\u0027Elixir.URI\u0027:merge/2"
},
{
"name": "\u0027Elixir.URI\u0027:to_string/1"
},
{
"name": "\u0027Elixir.String.Chars.URI\u0027:to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.18.6",
"status": "affected",
"version": "0.5.0",
"versionType": "semver"
},
{
"lessThan": "1.19.7",
"status": "affected",
"version": "1.19.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.20.5",
"status": "affected",
"version": "1.20.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.URI\u0027",
"\u0027Elixir.String.Chars.URI\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/uri.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.URI\u0027:parse/1"
},
{
"name": "\u0027Elixir.URI\u0027:split_authority/1"
},
{
"name": "\u0027Elixir.URI\u0027:merge/2"
},
{
"name": "\u0027Elixir.URI\u0027:to_string/1"
},
{
"name": "\u0027Elixir.String.Chars.URI\u0027:to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"changes": [
{
"at": "9a39d64a4473d02681c486bc70681c972479d32b",
"status": "unaffected"
},
{
"at": "b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58",
"status": "unaffected"
},
{
"at": "07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7",
"status": "unaffected"
},
{
"at": "d879b39d778fec2f475689573d5672720c4f2a21",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "39801821eef2d06524e5ebf5a0e4b3c380ad23ae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application parses an attacker-supplied URL with \u003ccode\u003eURI.parse/1\u003c/code\u003e, for example a URL field in a form or JSON request body, and then renders the result or a value containing it. The multi-second render cost requires Erlang/OTP 27, 28 or 29.0; on OTP 29.1 and later rendering a 1 MB port takes under a second. URLs in HTTP headers and the request line are bounded by the server\u0027s size limits.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application parses an attacker-supplied URL with `URI.parse/1`, for example a URL field in a form or JSON request body, and then renders the result or a value containing it. The multi-second render cost requires Erlang/OTP 27, 28 or 29.0; on OTP 29.1 and later rendering a 1 MB port takes under a second. URLs in HTTP headers and the request line are bounded by the server\u0027s size limits."
}
],
"value": "The application parses an attacker-supplied URL with URI.parse/1, for example a URL field in a form or JSON request body, and then renders the result or a value containing it. The multi-second render cost requires Erlang/OTP 27, 28 or 29.0; on OTP 29.1 and later rendering a 1 MB port takes under a second. URLs in HTTP headers and the request line are bounded by the server\u0027s size limits."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.6",
"versionStartIncluding": "0.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.7",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.5",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "reporter",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "coordinator",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-25T10:39:55.000Z",
"datePublic": "2026-10-30T08:54:08.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in the Elixir standard library\u0027s \u003ccode\u003eURI\u003c/code\u003e module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eURI.parse/1\u003c/code\u003e converts the port component with \u003ccode\u003eString.to_integer/1\u003c/code\u003e in \u003ccode\u003esplit_authority/1\u003c/code\u003e (\u003ccode\u003elib/elixir/lib/uri.ex\u003c/code\u003e) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises \u003ccode\u003eSystemLimitError\u003c/code\u003e. Rendering the parsed URI back to text (\u003ccode\u003eURI.to_string/1\u003c/code\u003e, \u003ccode\u003einspect/1\u003c/code\u003e, logging, error formatting) converts the bignum with \u003ccode\u003e:erlang.integer_to_binary/1\u003c/code\u003e, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\u003c/p\u003e\n\u003cp\u003eThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library\u0027s `URI` module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\n`URI.parse/1` converts the port component with `String.to_integer/1` in `split_authority/1` (`lib/elixir/lib/uri.ex`) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises `SystemLimitError`. Rendering the parsed URI back to text (`URI.to_string/1`, `inspect/1`, logging, error formatting) converts the bignum with `:erlang.integer_to_binary/1`, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\n\nThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library\u0027s URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\nURI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\n\nThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client that submits a URL with a port of hundreds of thousands of digits makes the server build a bignum of that size, and each later rendering of the parsed URI costs seconds of CPU on Erlang/OTP 27, 28 and 29.0. Sustained requests exhaust CPU on applications that parse and log, store or echo user-supplied URLs.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client that submits a URL with a port of hundreds of thousands of digits makes the server build a bignum of that size, and each later rendering of the parsed URI costs seconds of CPU on Erlang/OTP 27, 28 and 29.0. Sustained requests exhaust CPU on applications that parse and log, store or echo user-supplied URLs."
}
],
"value": "An unauthenticated client that submits a URL with a port of hundreds of thousands of digits makes the server build a bignum of that size, and each later rendering of the parsed URI costs seconds of CPU on Erlang/OTP 27, 28 and 29.0. Sustained requests exhaust CPU on applications that parse and log, store or echo user-supplied URLs."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T09:02:51.828Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg"
},
{
"name": "EEF CNA record for CVE-2026-109821",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-109821.html"
},
{
"name": "OSV record EEF-CVE-2026-109821",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-109821"
},
{
"name": "Erlang/OTP advisory for the same issue in uri_string",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2"
},
{
"name": "Introducing commit 3980182 in elixir-lang/elixir",
"tags": [
"related"
],
"url": "https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae"
},
{
"name": "Fix commit 9a39d64 in elixir-lang/elixir",
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b"
},
{
"name": "Fix commit b70f33a in elixir-lang/elixir",
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58"
},
{
"name": "Fix commit 07d9abc in elixir-lang/elixir",
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7"
},
{
"name": "Fix commit d879b39 in elixir-lang/elixir",
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed \u003ccode\u003eport\u003c/code\u003e above 65535 before rendering or using the \u003ccode\u003e%URI{}\u003c/code\u003e. \u003ccode\u003eURI.new/1\u003c/code\u003e is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where \u003ccode\u003e:uri_string\u003c/code\u003e limits the port to 5 digits.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed `port` above 65535 before rendering or using the `%URI{}`. `URI.new/1` is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where `:uri_string` limits the port to 5 digits."
}
],
"value": "Reject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed port above 65535 before rendering or using the %URI{}. URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where :uri_string limits the port to 5 digits."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eBuild \u003ccode\u003eurl = \"http://example.com:\" \u0026lt;\u0026gt; String.duplicate(\"9\", 400_000)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eURI.parse(url)\u003c/code\u003e returns in about 30 ms.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eURI.to_string(URI.parse(url))\u003c/code\u003e takes 2,613 ms on OTP 27.3.4.18, 2,604 ms on OTP 28.5 and 108 ms on OTP 29.1.1. With 200,000 digits it takes 654 ms on OTP 27 and 28, so the cost grows 4x per doubling.\u003c/li\u003e\n\u003cli\u003eThe same digits placed in the path instead of the port parse and render in 1 ms or less.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eURI.parse(\"http://example.com:65536\").port\u003c/code\u003e returns \u003ccode\u003e65536\u003c/code\u003e, and a port of 1,262,593 digits raises \u003ccode\u003eSystemLimitError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Build `url = \"http://example.com:\" \u003c\u003e String.duplicate(\"9\", 400_000)`.\n2. `URI.parse(url)` returns in about 30 ms.\n3. `URI.to_string(URI.parse(url))` takes 2,613 ms on OTP 27.3.4.18, 2,604 ms on OTP 28.5 and 108 ms on OTP 29.1.1. With 200,000 digits it takes 654 ms on OTP 27 and 28, so the cost grows 4x per doubling.\n4. The same digits placed in the path instead of the port parse and render in 1 ms or less.\n5. `URI.parse(\"http://example.com:65536\").port` returns `65536`, and a port of 1,262,593 digits raises `SystemLimitError`."
}
],
"value": "* Build url = \"http://example.com:\" \u003c\u003e String.duplicate(\"9\", 400_000).\n* URI.parse(url) returns in about 30 ms.\n* URI.to_string(URI.parse(url)) takes 2,613 ms on OTP 27.3.4.18, 2,604 ms on OTP 28.5 and 108 ms on OTP 29.1.1. With 200,000 digits it takes 654 ms on OTP 27 and 28, so the cost grows 4x per doubling.\n* The same digits placed in the path instead of the port parse and render in 1 ms or less.\n* URI.parse(\"http://example.com:65536\").port returns 65536, and a port of 1,262,593 digits raises SystemLimitError."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Unbounded conversion\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003esplit_authority/1\u003c/code\u003e matches the port with the regex \u003ccode\u003e(:(\\d*))?\u003c/code\u003e and converts it with \u003ccode\u003eString.to_integer/1\u003c/code\u003e. Nothing bounds the digit run, so the VM builds an integer of up to 1,262,592 decimal digits (about 30 ms to parse 400,000 digits) and raises \u003ccode\u003eSystemLimitError\u003c/code\u003e above that, which escapes \u003ccode\u003eURI.parse/1\u003c/code\u003e instead of producing a \u003ccode\u003e%URI{}\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Render cost\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eURI.to_string/1\u003c/code\u003e renders the port with \u003ccode\u003eInteger.to_string/1\u003c/code\u003e, and \u003ccode\u003einspect/1\u003c/code\u003e renders it the same way, both through \u003ccode\u003e:erlang.integer_to_binary/1\u003c/code\u003e. That conversion is quadratic on OTP 27, 28 and 29.0 and sub-quadratic from OTP 29.1 (\u003ca href=\"https://github.com/erlang/otp/pull/11074\" rel=\"noopener noreferrer\"\u003ehttps://github.com/erlang/otp/pull/11074\u003c/a\u003e). Per GHSA-8qw4-2chm-mvj2 it occupies a dirty CPU scheduler for its full duration.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Comparison with \u003ccode\u003eURI.new/1\u003c/code\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eErlang/OTP limited the port to 5 bytes in \u003ccode\u003e:uri_string.parse/1\u003c/code\u003e as part of GHSA-8qw4-2chm-mvj2. \u003ccode\u003eURI.new/1\u003c/code\u003e and \u003ccode\u003eURI.new!/1\u003c/code\u003e use \u003ccode\u003e:uri_string\u003c/code\u003e and get that limit on patched OTP versions. \u003ccode\u003eURI.parse/1\u003c/code\u003e does its own parsing and does not.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Reach\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eHeader-sourced URLs are bounded by HTTP server limits. Form and JSON body fields are not: Plug\u0027s default JSON body limit is 8 MB. One observed library path: a user-supplied URL passed to Req inside a Bandit request exits with the port in its arguments, and Bandit\u0027s error logging formats it, which took 2.8 seconds at 400,000 digits on OTP 28.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Unbounded conversion**\n\n`split_authority/1` matches the port with the regex `(:(\\d*))?` and converts it with `String.to_integer/1`. Nothing bounds the digit run, so the VM builds an integer of up to 1,262,592 decimal digits (about 30 ms to parse 400,000 digits) and raises `SystemLimitError` above that, which escapes `URI.parse/1` instead of producing a `%URI{}`.\n\n**2. Render cost**\n\n`URI.to_string/1` renders the port with `Integer.to_string/1`, and `inspect/1` renders it the same way, both through `:erlang.integer_to_binary/1`. That conversion is quadratic on OTP 27, 28 and 29.0 and sub-quadratic from OTP 29.1 (https://github.com/erlang/otp/pull/11074). Per GHSA-8qw4-2chm-mvj2 it occupies a dirty CPU scheduler for its full duration.\n\n**3. Comparison with `URI.new/1`**\n\nErlang/OTP limited the port to 5 bytes in `:uri_string.parse/1` as part of GHSA-8qw4-2chm-mvj2. `URI.new/1` and `URI.new!/1` use `:uri_string` and get that limit on patched OTP versions. `URI.parse/1` does its own parsing and does not.\n\n**4. Reach**\n\nHeader-sourced URLs are bounded by HTTP server limits. Form and JSON body fields are not: Plug\u0027s default JSON body limit is 8 MB. One observed library path: a user-supplied URL passed to Req inside a Bandit request exits with the port in its arguments, and Bandit\u0027s error logging formats it, which took 2.8 seconds at 400,000 digits on OTP 28."
}
],
"value": "1. Unbounded conversion\n\nsplit_authority/1 matches the port with the regex (:(\\d*))? and converts it with String.to_integer/1. Nothing bounds the digit run, so the VM builds an integer of up to 1,262,592 decimal digits (about 30 ms to parse 400,000 digits) and raises SystemLimitError above that, which escapes URI.parse/1 instead of producing a %URI{}.\n\n2. Render cost\n\nURI.to_string/1 renders the port with Integer.to_string/1, and inspect/1 renders it the same way, both through :erlang.integer_to_binary/1. That conversion is quadratic on OTP 27, 28 and 29.0 and sub-quadratic from OTP 29.1 (https://github.com/erlang/otp/pull/11074). Per GHSA-8qw4-2chm-mvj2 it occupies a dirty CPU scheduler for its full duration.\n\n3. Comparison with URI.new/1\n\nErlang/OTP limited the port to 5 bytes in :uri_string.parse/1 as part of GHSA-8qw4-2chm-mvj2. URI.new/1 and URI.new!/1 use :uri_string and get that limit on patched OTP versions. URI.parse/1 does its own parsing and does not.\n\n4. Reach\n\nHeader-sourced URLs are bounded by HTTP server limits. Form and JSON body fields are not: Plug\u0027s default JSON body limit is 8 MB. One observed library path: a user-supplied URL passed to Req inside a Bandit request exits with the port in its arguments, and Bandit\u0027s error logging formats it, which took 2.8 seconds at 400,000 digits on OTP 28."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-109821",
"datePublished": "2026-10-30T08:54:07.752Z",
"dateReserved": "2026-10-23T14:00:01.560Z",
"dateUpdated": "2026-10-30T16:52:43.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109380 (GCVE-0-2026-109380)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-13 15:40
VLAI
EPSS
VEX
Title
modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
Summary
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:39 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ayuhito/modern-tar/pull/195 | issue-trackingpatch |
| https://github.com/ayuhito/modern-tar/commit/181c… | patch |
| https://github.com/ayuhito/modern-tar/blob/v0.8.5… | technical-description |
| https://github.com/ayuhito/modern-tar | product |
| https://www.vulncheck.com/advisories/modern-tar-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ayuhito | modern-tar |
Affected:
0.3.5 , ≤ 0.8.5
(semver)
|
Date Public
2026-10-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:39:56.714376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:40:11.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/modern-tar",
"product": "modern-tar",
"repo": "https://github.com/ayuhito/modern-tar",
"vendor": "ayuhito",
"versions": [
{
"lessThanOrEqual": "0.8.5",
"status": "affected",
"version": "0.3.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lum Humolli"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:11.774Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #195",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ayuhito/modern-tar/pull/195"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e"
},
{
"name": "Vulnerable code in encoding.ts",
"tags": [
"technical-description"
],
"url": "https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/ayuhito/modern-tar"
},
{
"name": "VulnCheck Advisory: modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field"
}
],
"title": "modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109380",
"datePublished": "2026-10-12T20:55:11.774Z",
"dateReserved": "2026-10-12T14:23:25.691Z",
"dateUpdated": "2026-10-13T15:40:11.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107565 (GCVE-0-2026-107565)
Vulnerability from cvelistv5 – Published: 2026-10-08 14:39 – Updated: 2026-11-05 15:55
VLAI
EPSS
VEX
Title
Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
Summary
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:27 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-107565 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2547930 | issue-trackingx_refsource_REDHAT |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/a:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 5 |
cpe:/a:redhat:openshift:5
|
Date Public
2026-10-08 10:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:27:41.417046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:27:52.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "luksmeta",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "luksmeta",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "luksmeta",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "luksmeta",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:5"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 5",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Daniel Rond for reporting this issue."
}
],
"datePublic": "2026-10-08T10:50:41.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:55:24.837Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-107565"
},
{
"name": "RHBZ#2547930",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547930"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-05T12:44:08.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-08T10:50:41.000Z",
"value": "Made public."
}
],
"title": "Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-1284: Improper Validation of Specified Quantity in Input"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-107565",
"datePublished": "2026-10-08T14:39:28.679Z",
"dateReserved": "2026-10-08T10:50:10.040Z",
"dateUpdated": "2026-11-05T15:55:24.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107434 (GCVE-0-2026-107434)
Vulnerability from cvelistv5 – Published: 2026-10-10 19:36 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Summary
Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 11:55 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| videowhisper | MicroPayments |
Affected:
n/a , ≤ 3.2.9
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T11:55:46.921306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:33.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "paid-membership",
"product": "MicroPayments",
"vendor": "videowhisper",
"versions": [
{
"changes": [
{
"at": "3.2.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.2.9",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "JunHee CHO | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Bypass Vulnerability in MicroPayments \u003c= 3.2.9 versions."
}
],
"value": "Subscriber Bypass Vulnerability in MicroPayments \u003c= 3.2.9 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T19:36:24.555Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/paid-membership/vulnerability/wordpress-micropayments-plugin-3-2-9-bypass-vulnerability-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress MicroPayments \u2013 Fans Paysite / Paid Membership plugin to the latest available version (at least 3.2.10)."
}
],
"value": "Update the WordPress MicroPayments \u2013 Fans Paysite / Paid Membership plugin to the latest available version (at least 3.2.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress MicroPayments plugin \u003c= 3.2.9 - Bypass Vulnerability vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-107434",
"datePublished": "2026-10-10T19:36:24.555Z",
"dateReserved": "2026-10-08T00:19:19.566Z",
"dateUpdated": "2026-10-11T12:13:33.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107429 (GCVE-0-2026-107429)
Vulnerability from cvelistv5 – Published: 2026-10-12 07:44 – Updated: 2026-10-12 11:40 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability
Summary
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 11:31 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VideoWhisper.com | Paid Videochat Turnkey Site |
Affected:
0 , ≤ 7.5.12
(custom)
|
Date Public
2026-10-12 07:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-12T11:31:54.939897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T11:40:34.968Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "ppv-live-webcams",
"product": "Paid Videochat Turnkey Site",
"vendor": "VideoWhisper.com",
"versions": [
{
"changes": [
{
"at": "7.5.13",
"status": "unaffected"
}
],
"lessThanOrEqual": "7.5.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Erik Debye | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-12T07:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.\u003cp\u003eThis issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T07:45:57.540Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-12-other-vulnerability-type-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Paid Videochat Turnkey Site plugin to the latest available version (at least 7.5.13)."
}
],
"value": "Update the WordPress Paid Videochat Turnkey Site plugin to the latest available version (at least 7.5.13)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Paid Videochat Turnkey Site plugin \u003c= 7.5.12 - Other vulnerability Type vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-107429",
"datePublished": "2026-10-12T07:44:56.102Z",
"dateReserved": "2026-10-08T00:19:19.566Z",
"dateUpdated": "2026-10-12T11:40:34.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106605 (GCVE-0-2026-106605)
Vulnerability from cvelistv5 – Published: 2026-10-12 07:44 – Updated: 2026-10-12 11:40 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability
Summary
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 11:32 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WP Desk | Flexible Quantity – Measurement Price Calculator for WooCommerce |
Affected:
0 , ≤ 2.3.22
(custom)
|
Date Public
2026-10-12 07:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-12T11:32:07.255647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T11:40:35.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
"product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
"vendor": "WP Desk",
"versions": [
{
"changes": [
{
"at": "2.3.23",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.3.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Tang | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-12T07:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T07:45:21.300Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
}
],
"value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.22 - Other vulnerability Type vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-106605",
"datePublished": "2026-10-12T07:44:09.895Z",
"dateReserved": "2026-10-07T00:21:31.996Z",
"dateUpdated": "2026-10-12T11:40:35.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105754 (GCVE-0-2026-105754)
Vulnerability from cvelistv5 – Published: 2026-10-05 22:46 – Updated: 2026-10-08 02:31
VLAI
EPSS
VEX
Title
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:31 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vllm-project/vllm/security/adv… | x_refsource_CONFIRM |
| https://github.com/vllm-project/vllm/pull/51898 | x_refsource_MISC |
| https://github.com/vllm-project/vllm/commit/1970f… | x_refsource_MISC |
| https://github.com/vllm-project/vllm/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vllm-project | vllm |
Affected:
< 0.30.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:31:20.281715Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:31:29.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vllm",
"vendor": "vllm-project",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim\u0027s content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704: Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284: Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T22:46:03.163Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7"
},
{
"name": "https://github.com/vllm-project/vllm/pull/51898",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/pull/51898"
},
{
"name": "https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27"
},
{
"name": "https://github.com/vllm-project/vllm/releases/tag/v0.30.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.30.0"
}
],
"source": {
"advisory": "GHSA-ph72-cqr5-qpp7",
"discovery": "UNKNOWN"
},
"title": "vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105754",
"datePublished": "2026-10-05T22:46:03.163Z",
"dateReserved": "2026-10-05T19:11:07.947Z",
"dateUpdated": "2026-10-08T02:31:29.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
No CAPEC attack patterns related to this CWE.