Threats affecting pkg:generic/boost

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route.

Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory.

Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity.

Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity.

Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity.

A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.

Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to cause misconfigurations in the RMP potentially resulting in loss of integrity.

Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to trigger concurrent modifications to RMP entries without proper synchronization potentially resulting in loss of data integrity.

Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity.

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity.

The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another.

Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially resulting in a loss of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory integrity.

compose-lint versions 0.31.0 up to but not including 0.32.0 allow specially crafted text in a pull request to inject GitHub Actions workflow commands via JSON or SARIF output printed to stdout. This can cause the CI runner to create annotations, fold logs, or execute other accepted commands without changing the pass/fail result. The issue does not affect output written to files or the official GitHub Action, which disables command processing around compose-lint runs. The vulnerability is fixed in version 0.32.0.

CVE-2026-92441 is a high-severity vulnerability in Kong Gateway Enterprise and Kong AI Gateway. It involves CRLF injection via decoded carriage return and line feed characters in the X-Forwarded-Prefix header on regex routes. This flaw allows HTTP header injection and request smuggling attacks against upstream services. Multiple versions prior to fixed releases are affected.

Active Storage versions prior to 8.0.5.2 and between 8.1.0.beta1 and 8.1.4.1 are vulnerable to arbitrary file read and potential remote code execution via crafted video previews, analysis, and image processing. The vulnerability arises because the tempfile used for uploaded blobs retains the original file extension, which influences how external tools like FFmpeg and ImageMagick decode the file. An attacker controlling the filename and content type can cause these tools to execute unintended decoders, including AviSynth scripts in FFmpeg builds with AviSynth support, potentially leading to file disclosure or remote code execution. Fixed versions restrict the tempfile extension to those matching the blob's content type, mitigating this risk.

Active Storage's Google Cloud Storage direct upload feature did not enforce file size limits properly, allowing clients to upload files larger than the declared size. This could bypass application-level file size validations and quotas. The issue was fixed by signing an 'x-goog-content-length-range' header that enforces the declared size, with fixed versions released.

CVE-2026-92439 is a high-severity vulnerability in Kong Gateway Enterprise's SAML plugin. It fails to enforce the AudienceRestriction condition, allowing a valid SAML assertion issued for a different Service Provider to be replayed to authenticate to Kong. This improper authentication flaw affects multiple versions of Kong Gateway Enterprise prior to their respective fixed releases.

A SQL injection vulnerability exists in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway. This flaw allows a client to execute arbitrary SQL commands against the Kong database by submitting a specially crafted model name. The vulnerability has a high severity score of 8.7 and was published on November 10, 2026. No affected versions or patch information are provided in the available data.

Media Encoder contains an Incorrect Authorization vulnerability that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file, and depends on conditions outside the attacker's control. The vulnerability changes the security scope, potentially allowing elevated impact.

Adobe Premiere Pro contains an out-of-bounds write vulnerability that may allow an attacker to execute arbitrary code with the privileges of the current user. Successful exploitation requires user interaction, specifically opening a malicious file. The vulnerability is identified as CVE-2026-82012 and has a high severity rating with a CVSS score of 7.8.