CVE-2026-88833 is an integer underflow vulnerability in the BusyBox udhcpc DHCP client used in Red Hat Hardened Images. The flaw occurs when the client processes raw DHCP packets and replaces the validated packet length with an attacker-controlled value from the IP header without re-validation. This leads to an integer underflow during header size subtraction, causing a memory copy operation with an excessively large length. An attacker on the same network segment can exploit this to crash the DHCP client, resulting in denial of service and loss of network connectivity.
### Summary
`dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin `302` redirect receives the victim's `Authorization`, `Cookie`, and `Proxy-Authorization` headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because `followRedirects` is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.
### Details
When `Dio` is configured to use `Http2Adapter`, the adapter's internal `_fetch` method constructs HTTP/2 request headers by unconditionally copying all entries from `options.headers`:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:111
headers.addAll(
options.headers.entries.map((entry) {
...
return Header.ascii(entry.key.toLowerCase(), v);
}).toList(),
);
```
On receiving a `3xx` response, the adapter reads the `Location` header and resolves the redirect target URI:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:254-263
final url = responseHeaders.value('location');
final uri = Uri.parse(url ?? '');
final String path = resolveRedirectUri(options.uri, uri).toString();
return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...);
```
`options.copyWith` is called without an explicit `headers` argument; `dio/lib/src/options.dart:629` therefore preserves the full original header map via `headers ?? Map.from(this.headers)`. `resolveRedirectUri` (`http2_adapter.dart:290`) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including `Authorization`, `Cookie`, and `Proxy-Authorization` — is forwarded to the new authority with no sanitization.
**Data flow (source → sink):**
1. `dio/lib/src/dio_mixin.dart:383` — public `Dio.request<T>(String path, ...)` entry point.
2. `dio/lib/src/options.dart:331` — base and per-request headers merged into `RequestOptions`.
3. `dio/lib/src/dio_mixin.dart:596` — `httpClientAdapter.fetch(reqOpt, ...)` dispatches to `Http2Adapter`.
4. `plugins/http2_adapter/lib/src/http2_adapter.dart:254` — `Location` header is read from the network response (attacker-controlled source).
5. `plugins/http2_adapter/lib/src/http2_adapter.dart:258` — redirect target URI resolved; cross-origin check absent.
6. `plugins/http2_adapter/lib/src/http2_adapter.dart:260` — `options.copyWith(path: path, ...)` called without `headers` override.
7. `dio/lib/src/options.dart:629` — `copyWith` preserves `Map.from(this.headers)` — all sensitive headers retained.
8. `plugins/http2_adapter/lib/src/http2_adapter.dart:111` — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink).
**Suggested patch** — strip sensitive headers before following a cross-origin redirect:
```diff
--- a/plugins/http2_adapter/lib/src/http2_adapter.dart
+++ b/plugins/http2_adapter/lib/src/http2_adapter.dart
+ static const _sensitiveRedirectHeaders = {
+ 'authorization',
+ 'cookie',
+ 'proxy-authorization',
+ };
+
- final String path = resolveRedirectUri(options.uri, uri).toString();
+ final redirectUri = resolveRedirectUri(options.uri, uri);
+ final redirectOptions = options.copyWith(
+ path: redirectUri.toString(),
+ maxRedirects: --options.maxRedirects,
+ );
+ if (!_sameOrigin(options.uri, redirectUri)) {
+ redirectOptions.headers.removeWhere(
+ (name, _) => _sensitiveRedirectHeaders.contains(name.toLowerCase()),
+ );
+ }
return _fetch(
- options.copyWith(path: path, maxRedirects: --options.maxRedirects),
+ redirectOptions,
list != null ? Stream.fromIterable(list) : null,
cancelFuture,
redirects,
);
+
+ static bool _sameOrigin(Uri a, Uri b) =>
+ a.scheme == b.scheme && a.host == b.host && a.port == b.port;
```
### PoC
The following steps reproduce the vulnerability using two local HTTP/2 cleartext (h2c) servers inside an isolated Docker container (no external network required).
**Prerequisites:**
- Docker installed and accessible.
- Repository checked out at the path used as the build context.
**Build and run:**
```bash
# From the repository root (github_web_81_cfug__dio/)
docker build -f vuln-001/Dockerfile -t dio-vuln-001:poc .
docker run --rm --network none dio-vuln-001:poc
```
**What the container does:**
1. Starts an *origin* h2c server on `127.0.0.1:18081` that immediately returns `302 Location: http://127.0.0.1:18082/capture`.
2. Starts an *attacker* h2c server on `127.0.0.1:18082` that logs every received header.
3. Executes the following Dart exploit:
```dart
final dio = Dio()
..httpClientAdapter = Http2Adapter(ConnectionManager());
await dio.get(
'http://127.0.0.1:18081/start',
options: Options(headers: {
'Authorization': 'Bearer SECRET
This content is a discussion post about the revamped SANS course SEC573, which focuses on AI-powered security automation using Python, large language models, and MCP. It is a user inquiry seeking opinions and recommendations about the course's value and preparation tips.
CVE-2026-102342 is a stored cross-site scripting (XSS) vulnerability in the rust-ammonia library, which is used to sanitize untrusted HTML. Versions prior to 3.3.3, 4.0.3, and 4.1.4 allow SVG animate or set elements with an attributeName targeting href and a javascript scheme value to persist. This enables attackers to embed script-bearing links that execute attacker-controlled scripts in the application's origin when clicked. The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.
CVE-2026-65200 is an integer underflow vulnerability in Huawei openBMC's device-management process. The flaw occurs in the parsing of PLDM-over-MCTP and NCSI-over-MCTP responses, where the code subtracts a fixed header size from a device-supplied response length without checking for lower bounds. This can cause the length to wrap around to a large value, leading to out-of-bounds reads. The vulnerability affects the base PLDM control class and Huawei NCSI driver, making it reachable by any PLDM endpoint or Huawei NIC on the internal management bus. The CVSS score is 3.5, indicating low severity. No known exploits are reported in the wild, and no patch information is provided.
CVE-2025-58774 is a high-severity vulnerability in AMI AptioV BIOS involving buffer access with an incorrect length value. It can be triggered by local users, potentially causing buffer overflows, memory corruption, and arbitrary code execution. This vulnerability affects confidentiality, integrity, and availability of the system.
yt-dlp-web-ui versions up to 4.0.0 contain a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method. This flaw allows remote unauthenticated attackers to crash the server by sending a specially crafted request with a url value such as --version, which triggers invalid JSON output and an unrecovered panic that terminates the process.
Virtualenvwrapper versions before 4.8.4_2 and 6.1.1_3 improperly handle line boundaries in the 'prompt' value written to pyvenv.cfg, allowing crafted prompts containing line breaks to inject or overwrite configuration keys such as 'home'. This can mislead tooling that relies on 'home' to locate the base interpreter. The vulnerability requires the prompt to be influenced by external, untrusted input, such as CI job templates or environment variables. A patch is available that sanitizes line boundaries by collapsing them to spaces during serialization.
A reference leak vulnerability exists in the items-view union and subtraction operators of aio-libs/multidict versions 6.7.0 through 6.9.0. This flaw allows a remote client to cause unbounded memory growth by leaking key-identity and value objects during certain set operations on dictionary views. The leak occurs because the code fails to release new strong references created during iteration, leading to unreclaimable memory until the process is terminated. This issue affects servers using aio-libs that build these views over attacker-controlled HTTP headers or query strings.
TYPO3 CMS versions 14.0.0 through 14.3.8 contain a vulnerability where forms using FileUpload or ImageUpload elements with a custom saveToFileMount setting incorrectly store uploaded files in the default public storage folder instead of the intended restricted storage. This misplacement causes uploaded files to be publicly accessible without the intended access controls. Forms using the default saveToFileMount value are not affected.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
CVE-2026-89197 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The issue arises from improper validation or sanitization of input in the Value field of notification conditions during Notification Profile configuration. An authenticated attacker with specific privileges could exploit this flaw to execute arbitrary SQL commands on the device's underlying database.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw arises from overlapping quantified regex groups that cause quadratic backtracking on failing matches, leading to significant CPU consumption when parsing crafted long selectors. This vulnerability is exploitable when user-controlled CSS selectors are passed to soupsieve or BeautifulSoup's select methods. The issue affects soupsieve versions prior to 3.24.1_1 and 3.27.1, with fixes available in those versions.
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the write path correctly uses $wpdb->prepare(), but that protection is not carried forward to the read path, where the retrieved value is concatenated unsanitized into unprepared queries in both a single-quoted string context and a bare numeric context.
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host RX thread, while delayable_msg_handler() runs on the system workqueue. Both block while the lists are in an intermediate state — the enqueuer in bt_rand(), both in bt_mesh_access_send() — which lets the other context observe torn state. delayable_msg_handler() used the result of sys_slist_get() on busy_ctx without a NULL check, and allocate_delayable_msg_ctx() tested sys_slist_is_empty() and then assumed a separate sys_slist_get() would succeed.
Because CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG and CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED default to y, every model response to a received mesh message is parked on this queue, so the enqueuer runs as a direct consequence of inbound traffic. A peer that can get access-layer messages accepted by a model (it must hold the NetKey and a bound AppKey, so a legitimate or compromised network member) controls the arrival rate, the size of the elicited responses and the destination address, and thereby controls occupancy of the 4-entry context pool and the 40-entry chunk pool. Exhausting the chunk pool forces bt_mesh_delayable_msg_manage() down the purge path, which sends and releases the only queued message and leaves busy_ctx empty while the delayable work item is still armed; if the enqueuer then yields, the handler runs against the empty list.
The result is a read-modify-write through a NULL-based pointer (pending_msg->fired_time += 10) at a fixed low address on the system workqueue thread. On typical targets that faults, aborting the system workqueue thread — which stops all workqueue-driven functionality, including the mesh timing machinery — or resetting the node, so the impact is loss of availability of the affected node. The write value and address are fixed and no attacker-controlled length or index is involved, so this is not exploitable for memory corruption or code execution. The same unsynchronized window also allowed one message context to be selected and released by two contexts at once, producing duplicated transmissions, duplicated send-completion callbacks and crossed chunk ownership.
The fix serializes every list mutation with a k_spinlock that is never held across a blocking call, makes push_msg_from_delayable_msgs() detach the queue head atomically so a message being sent is on no list, removes the unchecked sys_slist_get() from delayable_msg_handler(), and drops any message that reaches the front of the queue while the stack is suspended or reset.
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
CVE-2026-84312 is an improper authentication vulnerability in the Casdoor SSO flow of 0xJacky nginx-ui. The OAuth state parameter is hard-coded and not validated against a per-session value, enabling login CSRF attacks. An attacker can force a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions prior to 2.4.1. A patch is available that implements proper state parameter generation and validation similar to the OIDC flow.