A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox version 7.2.8 and multiple other specific versions. This vulnerability allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to gain unauthorized read access to some data accessible by VirtualBox. The vulnerability has a CVSS 3.1 base score of 3.2, indicating a medium severity with confidentiality impact only. There is no indication of integrity or availability impact. The vulnerability scope includes potential impact on additional products beyond VirtualBox itself.
A vulnerability in elixir-grpc grpc allows unauthenticated attackers to cause denial of service by exhausting the atom table or achieve remote code execution via unsafe deserialization. The issue arises from the use of :erlang.binary_to_term/1 without safe options or size/type checks on gRPC messages with Content-Type: application/grpc+erlpack. This affects grpc versions including 0.10.2-1, 0.11.1-1, 1.3.2-1, 1.16.1-1, 1.30.2-3, and 1.51.1-4 among others. The vulnerability can crash the BEAM node or execute attacker-controlled code if the decoded term is invoked downstream.
OpenStack Ironic versions before 37.0.1 have a vulnerability where applying a PATCH request to update authorized volume property fields can cause the system to return unredacted sensitive information, such as iSCSI credentials. This issue affects multiple Ubuntu package versions of Ironic. The vulnerability does not affect POST requests. The CVSS score is 6.8, indicating a medium severity.
A memory exhaustion vulnerability exists in the Netty HTTP/3 codec in versions starting from 4.2.0.Final up to but not including 4.2.15.Final. This flaw allows the creation of an infinite number of blocked streams, potentially causing an out-of-memory (OOM) error. The issue is patched in version 4.2.15.Final.
Netty QUIC versions prior to 4.2.15.Final expose the stateless reset token on the network path when using default HMAC-based connection-ID and stateless-reset-token generators. This exposure allows an on-path attacker to derive the reset token from QUIC headers after a source connection ID rotation and potentially perform a Denial of Service by sending spoofed Stateless Reset packets. The issue is fixed in version 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in the SimpleTrustManagerFactory.engineGetTrustManagers() method. This flaw causes user-supplied plain X509TrustManager instances to be wrapped improperly, resulting in the omission of hostname verification despite the default setting of endpointIdentificationAlgorithm="HTTPS". This means clients using certain custom trust managers may not perform hostname verification, potentially allowing man-in-the-middle attacks. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in RedisArrayAggregator where it pre-allocates an ArrayList with an initial capacity based on a RESP array element count taken from the wire. A maliciously crafted small header can specify a very large initial capacity, potentially causing resource exhaustion. This issue is patched in versions 4.1.135.Final and 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in HttpObjectDecoder where it skips all ISO control bytes and whitespace before reading the first HTTP request line. This behavior exceeds the HTTP specification's allowance to ignore only empty CRLF lines before the request line, potentially causing request-boundary confusion in pipelined or multiplexed transports. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final have a vulnerability in HTTP/2 max header size handling that can cause an attack similar to HTTP/2 Rapid Reset. When a client sends the SETTINGS_MAX_HEADER_LIST_SIZE setting, Netty processes the request but throws an exception while writing response headers. This behavior can disrupt service availability. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
A vulnerability in netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final allows an attacker to cause an IndexOutOfBoundsException by setting a PP2_TYPE_SSL TLV length below 5. This exception is not properly caught, leading to a retained slice on the pooled cumulation buffer never being released, which can cause resource exhaustion. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
A vulnerability in Netty's NoQuicTokenHandler prior to version 4.2.15.Final causes the server to incorrectly validate tokens, allowing an attacker to bypass the anti-amplification send limit in QUIC handshake packets. This can lead to reflection attacks where a victim IP receives amplified handshake traffic. The issue is fixed in version 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in the SslClientHelloHandler.decode() method where the TLS handshake length is read and a large buffer allocation is made without proper length checks or timeout scheduling. This can lead to excessive memory allocation and retention until the channel closes. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a resource leak vulnerability in the netty_unix_socket_recvFd function. The issue arises when receiving SCM_RIGHTS control messages carrying two file descriptors, causing the function to skip closing leaked file descriptors due to an incorrect length check. This leads to file descriptor leaks when using DomainSocketChannel with DomainSocketReadMode.FILE_DESCRIPTORS enabled. The vulnerability has been patched in versions 4.1.135.Final and 4.2.15.Final.
Netty versions prior to 4.1.135.Final and 4.2.15.Final have a vulnerability in their DNS resolver where a predictable pseudo-random number generator (PRNG) is used for DNS transaction IDs and a static UDP source port is the default. This reduces the entropy of DNS queries and enables DNS cache poisoning attacks, such as the Kaminsky attack. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
A vulnerability in netty-transport-sctp versions prior to 4.1.135.Final and 4.2.15.Final allows an attacker to cause unbounded memory growth by sending many incomplete SCTP message fragments. The handler accumulates fragments into a composite buffer chain without limits, which can grow indefinitely if the 'complete' flag is never set. This can lead to denial of service due to resource exhaustion. Versions 4.1.135.Final and 4.2.15.Final include patches for this issue.
Netty versions prior to 4.1.135.Final and 4.2.15.Final have a vulnerability where the DefaultHttp2Connection.DefaultEndpoint initializes maxActiveStreams and maxStreams to Integer.MAX_VALUE, effectively imposing no limit on concurrent HTTP/2 streams. This can lead to excessive resource consumption on the server side, as each open stream allocates multiple objects and state entries. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
Netty HTTP/3 codec versions prior to 4.2.15.Final have a vulnerability where the default Http3ConnectionHandler configuration does not enforce a maximum header size limit. This allows a malicious peer to send an excessive number of headers, potentially causing memory exhaustion and a Denial of Service via an OutOfMemoryError. The issue is fixed in version 4.2.15.Final.
Netty-codec-redis versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability where an attacker can cause a denial of service (DoS) by sending a crafted Redis payload with deeply nested arrays. This leads to excessive memory allocation and an OutOfMemoryError, disrupting service availability. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
In netty-codec-redis versions prior to 4.1.135.Final and 4.2.15.Final, an attacker can cause a denial of service (DoS) by sending specially crafted Redis payloads across multiple connections without proper line termination. This triggers exhaustion of the server's direct memory pool, resulting in an OutOfDirectMemoryError and preventing legitimate connections from being processed. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.
Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when using the fetch adapter. This allowed sending or receiving bodies larger than maxContentLength or maxBodyLength despite configured limits. The issue could lead to resource exhaustion in server-side applications. The vulnerability is fixed in versions 0.32.0 and 1.16.0.