Refine your search
4 vulnerabilities found for by esa
CVE-2026-76077 (GCVE-0-2026-76077)
Vulnerability from cvelistv5
Published
2026-11-05 16:49
Modified
2026-11-05 16:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "asn1scc",
"vendor": "esa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.7.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer\u0027s stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:49:58.765Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"
},
{
"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"
},
{
"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"
}
],
"source": {
"advisory": "GHSA-38q3-fg5h-wwf9",
"discovery": "UNKNOWN"
},
"title": "ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-76077",
"datePublished": "2026-11-05T16:49:58.765Z",
"dateReserved": "2026-08-18T21:17:32.199Z",
"dateUpdated": "2026-11-05T16:49:58.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75615 (GCVE-0-2026-75615)
Vulnerability from cvelistv5
Published
2026-11-05 16:49
Modified
2026-11-05 16:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "asn1scc",
"vendor": "esa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.7.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a decoded character index before reading allowedCharSet. For string alphabets whose size is not a power of two, a crafted message can select an unused encoded index, read a small bounded window of adjacent static program constants, and return the byte as a successfully decoded character. The full 128-character IA5String alphabet is not affected. This issue is fixed in version 4.7.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:49:20.422Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-234q-m7gr-pcf8"
},
{
"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"
},
{
"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"
}
],
"source": {
"advisory": "GHSA-234q-m7gr-pcf8",
"discovery": "UNKNOWN"
},
"title": "ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-75615",
"datePublished": "2026-11-05T16:49:20.422Z",
"dateReserved": "2026-08-17T23:49:03.451Z",
"dateUpdated": "2026-11-05T16:49:20.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75614 (GCVE-0-2026-75614)
Vulnerability from cvelistv5
Published
2026-11-05 16:47
Modified
2026-11-05 18:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75614",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T18:25:12.643188Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:26:01.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "asn1scc",
"vendor": "esa",
"versions": [
{
"status": "affected",
"version": "\u003c 4.7.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a power of two. Generated uPER and ACN decoders for variable-size SEQUENCE OF, OCTET STRING, BIT STRING, and string values use the invalid result as a loop or copy length, so a crafted over-range size field can write beyond a destination buffer. Decoding untrusted affected data can corrupt heap or stack memory, cause a crash, or potentially permit code execution. This issue is fixed in version 4.7.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:47:56.986Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/esa/asn1scc/security/advisories/GHSA-825c-7h77-2jjq"
},
{
"name": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"
},
{
"name": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/asn1scc/releases/tag/4.7.0.1"
}
],
"source": {
"advisory": "GHSA-825c-7h77-2jjq",
"discovery": "UNKNOWN"
},
"title": "ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-75614",
"datePublished": "2026-11-05T16:47:56.986Z",
"dateReserved": "2026-08-17T23:49:03.451Z",
"dateUpdated": "2026-11-05T18:26:01.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54086 (GCVE-0-2026-54086)
Vulnerability from cvelistv5
Published
2026-10-13 18:28
Modified
2026-10-16 22:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54086",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T22:26:56.654769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T22:27:10.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sleapi-j",
"vendor": "esa",
"versions": [
{
"status": "affected",
"version": "\u003c 5.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:28:25.345Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/esa/sleapi-j/security/advisories/GHSA-6g75-jwgj-hj8v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/esa/sleapi-j/security/advisories/GHSA-6g75-jwgj-hj8v"
},
{
"name": "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc"
},
{
"name": "https://github.com/esa/sleapi-j/releases/tag/5.1.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/esa/sleapi-j/releases/tag/5.1.7"
}
],
"source": {
"advisory": "GHSA-6g75-jwgj-hj8v",
"discovery": "UNKNOWN"
},
"title": "SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54086",
"datePublished": "2026-10-13T18:28:25.345Z",
"dateReserved": "2026-06-11T18:44:47.761Z",
"dateUpdated": "2026-10-16T22:27:10.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}