A denial of service vulnerability exists in hickory-dns versions from 0.20.1 up to but not including 0.26.2. The flaw is in the hickory-proto SVCB and HTTPS record parser, where specially crafted zone files with single or double quotes replacing service parameter values cause a panic and crash the parser.
Hickory DNS versions from 0.24.0 up to but not including 0.26.2 have a resource exhaustion vulnerability. Remote attackers can exploit this by sending large DNS over HTTP (DoH) request bodies over HTTP/2 or HTTP/3, causing the server to consume excessive memory and potentially leading to denial of service.
Sveltejs devalue versions before 5.6.3 contain a prototype pollution vulnerability. This flaw allows attackers to manipulate object prototypes by providing untrusted data to the uneval function. When the affected code evaluates this data, it results in objects with polluted prototypes, causing output data to differ in structure from the original input. The vulnerability has a medium severity rating with a CVSS score of 4.4.
A vulnerability in the DNS wire-format message parser of hickory-proto (Hickory DNS) versions 0.18 up to but not including 0.26.2 allows remote attackers to cause excessive memory allocation. The parser preallocates record vectors based on untrusted header fields (ANCOUNT, NSCOUNT, ARCOUNT), which can be set to 65535 by an attacker, leading to about 18MB of memory allocation per message. This can result in a denial of service due to resource exhaustion.
A vulnerability in the zone file parser of the hickory-proto crate in Hickory DNS versions 0.24.0 up to but not including 0.26.2 causes the parser to panic when processing a single token of 4096 bytes or longer. This can be exploited by attackers supplying crafted zone files to trigger a denial of service.
Zebra versions prior to 7.0.0 have an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. This causes quadratic digest recomputation under ZIP-244 or ZIP-243, stalling Rayon-backed block verification for minutes and resulting in a denial of service.
Sveltejs devalue versions before 5.9.3 have a resource exhaustion vulnerability caused by repeated primitive strings triggering quadratic expansion in the uneval function. This can lead to excessive memory or CPU consumption when processing crafted payloads.
Zebra versions from 2.3.0 up to but not including 7.0.0 have a denial of service vulnerability. This flaw allows unauthenticated peers to bypass misbehavior scoring by submitting transactions or blocks containing invalid transparent scripts. Exploitation can lead to mempool flooding with script-failing transactions or delivery of forged v5 block bodies with altered scriptSig bytes, causing CPU exhaustion and repeated stalling of block synchronization.
ZcashFoundation Zebra zebrad versions before 7.0.0 have a reachable assertion race condition that allows unauthenticated remote peers to abort the node. This occurs when malicious peers trigger disconnection during a blocked outbound send by returning empty FindBlocks or FindHeaders replies and ceasing to read their socket, causing syncing nodes to terminate.
Sveltejs devalue versions from 1.0.0 up to but not including 5.9.3 contain a memory exhaustion vulnerability in the uneval function. The flaw arises because the generated code for sparse arrays allocates memory proportional to the declared length of the array when evaluated. An attacker who can control a very large sparse array serialized by an application could cause memory exhaustion in the browser or runtime environment processing the output.
Sveltejs devalue versions before 5.6.4 have a prototype injection vulnerability. This flaw allows attackers to inject __proto__ properties into objects returned by devalue.parse and devalue.unflatten. If downstream code merges these objects using Object.assign, the prototype of the target object can be altered. The vulnerability has a low severity score of 3.7 and does not impact confidentiality or availability but can cause integrity issues.
The devalue library versions 5.8.0 through before 5.9.3 contain an unhandled promise rejection vulnerability in the stringifyAsync function. This occurs when serializing multiple promises where a later promise rejects before an earlier one settles, causing an internal rejection to remain unhandled even if the caller catches the returned promise. This flaw can be exploited by an attacker who can influence the timing or failure of asynchronous values to cause the Node.js process to terminate unexpectedly.
Devalue versions before 5.9.3 have a validation bypass vulnerability in the parse function that allows custom ArrayBuffer revivers to skip typed-array allocation checks. This flaw can be exploited by attackers supplying crafted input to cause allocation of very large ArrayBuffers, leading to memory exhaustion and denial of service.
Zebra zebrad versions prior to 7.0.0 contain a denial of service vulnerability. A malicious peer can exploit this flaw by cancelling the verifier rewind after a failed commit, which stalls checkpoint synchronization. This allows attackers to serve forged blocks with altered authorizing data combined with a restart-triggering block, causing the verifier to reject legitimate blocks until the service is restarted.
Zebra versions prior to 7.0.0 have a vulnerability where unauthenticated peers can stall the initial synchronization process by sending a forged checkpoint block body. This causes the node to stop requesting blocks until it is restarted.
Sveltejs devalue versions before 5.9.3 have a denial of service vulnerability. Attackers can supply sparse arrays to the uneval function, causing CPU amplification and blocking the event loop by forcing synchronous work proportional to the array's declared length.
A vulnerability in devalue versions before 5.9.3 allows attackers to bypass the __proto__ property rejection during parsing by using malformed null-prototype object keys through property-key coercion. This is an incomplete fix related to a previous advisory (GHSA-mwv9-gp5h-frr4). Although attackers can craft payloads that produce objects with a __proto__ own property, this alone does not lead to prototype pollution.
OpenAM versions prior to 16.1.4 include built-in identities in the Top Level Realm with default passwords that are identical across all installations and publicly known. These default credentials allow unauthenticated remote attackers to log in as these identities and obtain authenticated sessions. Additionally, agent identities can access configuration details of other agent profiles.
ZcashFoundation Zebra versions from 4.5.0 up to but not including 7.0.0 have a vulnerability in their protection mechanism that causes honest peers to be banned incorrectly. This occurs because the software scores mempool lock-time rejections at the ban threshold, allowing attackers to broadcast transactions locked until the current block height immediately after each block. As a result, nodes that are lagging can mistakenly ban honest relaying peers for 24 hours or until they restart.
Zebra zebrad versions 6.4.0 up to but not including 7.0.0 contain a vulnerability where the mempool coinbase-maturity check performs quadratic work. This occurs because the function Transaction::coinbase_spend_restriction() rebuilds the transaction's output list repeatedly for each spent outpoint. An attacker can exploit this by sending many unsigned transactions with numerous transparent inputs and outputs, causing excessive CPU usage and pinning verification threads without incurring a misbehavior score.