Threats Tagged 'cwe-460'

Eclipse Milo versions 1.0.0 through 1.1.4 contain a vulnerability where monitored-item quota accounting is not exception-safe. An unauthenticated remote client can trigger a StackOverflowError by sending deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter. This causes the server-global monitored-item quota to be exhausted and prevents new monitored items from being created until the server is restarted. Existing monitored items and other server functions remain unaffected.

> [!NOTE] > The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service. ## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. Additionally, fetch_data() finally block clears the JWKS cache on network error. ## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data. ## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth) ## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block ## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

CVE-2026-33481 is a medium severity vulnerability in Anchore Syft versions prior to 1.42.3 where temporary files are not properly cleaned up if an error occurs due to exhausted temporary storage during scanning. This can happen when scanning very large or highly compressed artifacts, causing Syft to exit without removing temporary files, which may fill the temporary storage and prevent future scans or other system utilities from functioning properly. The issue is fixed in Syft version 1.42.3, which ensures cleanup of temporary files even on error. No workarounds exist, but manual removal of leftover temporary files can restore storage availability.

libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation.

LowVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-59399#cwe-460