Open Source Vulnerabilities

gst-plugins-bad

GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

raptor2

raptor_xml_writer_start_element_common in raptor_xml_writer

php85, php84, php83

In PHP 8

raptor2

malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

gitaly

Security fix for GHSA-8392-8m93-v3w7 applied in: gitaly 14-9-3-r0

nodetaint, gitaly

Security fix for GHSA-69cg-p879-7622 applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nodetaint, gitaly

Security fix for GHSA-4f99-4q7p-p3gh applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

nodetaint, gitaly

Security fix for GHSA-4374-p667-p6c8 applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

tar

nodetaint, falcosidekick, falcosidekick-fips, go-fips-1.24, gitaly

Security fix for GHSA-v778-237x-gjrc applied in: nodetaint 0.0.4-r1, falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, go-fips-1.24 1.24.12-r0, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

nodejs, nodejs

flaw in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

When Conn

opensearch-dashboards-3-dashboards-reporting, opensearch-dashboards-3-dashboards-reporting

opensearch-dashboards-3-dashboards-reporting, opensearch-dashboards-3-dashboards-reporting

nodejs, nodejs

flaw in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

nodejs, nodejs

We have identified a bug in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Reader

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

ParseAddress function constructs domain-literal address components through repeated string concatenation

nodejs, nodejs

flaw in Node

nodejs, nodejs

flaw in Node

go-fips-1.24, go-fips-1.24

When using http

nodejs, nodejs

malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node

gatekeeper, gatekeeper-fips, newrelic-k8s-metadata-injection, nats-server-fips, cloudflared, go-fips-1.24, go-fips-1.24

Downloading and building modules with malicious version strings can cause local code execution

nodejs, nodejs

Security fix for GHSA-73rr-hh4g-fpgx applied in: nodejs 25.4.0-r0, nodejs 25.4.0-r1

gatekeeper, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, cloudflared, go-fips-1.24, go-fips-1.24

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

step-cli, nats-server-config-reloader-fips, gatekeeper, gatekeeper-fips, nats-server-config-reloader-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, cloudflared, go-fips-1.24, go-fips-1.24

net/url package does not set a limit on the number of query parameters in a query

nodejs, nodejs

node-tar,a Tar for Node

nodejs, nodejs

node-tar is a Tar for Node

nextcloud-server-32

nextcloud-server-32

step-cli, nats-server-config-reloader-fips, gatekeeper, gatekeeper-fips, nats-server-config-reloader-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, cloudflared, go-fips-1.24, go-fips-1.24

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

cups

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER

cups

buffer overflow issue was addressed with improved memory handling

cups

buffer overflow issue was addressed with improved memory handling

cups

buffer overflow was addressed with improved bounds checking

cups

memory corruption issue was addressed with improved validation