Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. We have patched the issue in GitHub commit 2b56169c16e375c521a3bc8ea658811cc0793784. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

CVE-2022-41884 is a medium-severity vulnerability identified in TensorFlow, an open-source machine learning platform widely used for developing and deploying machine learning models. The vulnerability is categorized under CWE-670, which refers to 'Always-Incorrect Control Flow Implementation.' Specifically, the issue arises when a numpy array is created with a shape where one dimension is zero and the other dimensions sum to a large number. Under these conditions, TensorFlow raises an error due to improper handling of control flow logic related to array shapes. This flaw can lead to unexpected behavior or crashes during model training or inference, potentially disrupting machine learning workflows. The vulnerability affects TensorFlow versions prior to 2.8.4, versions from 2.9.0 up to but not including 2.9.3, and versions from 2.10.0 up to but not including 2.10.1. The issue has been addressed in TensorFlow 2.11 and backported to 2.10.1, 2.9.3, and 2.8.4. There are no known exploits in the wild at this time, and exploitation does not appear to require authentication or user interaction, but it requires the attacker to supply crafted input data that triggers the faulty control flow. The root cause is an incorrect implementation of control flow logic when handling specific numpy array shapes, which can cause errors or crashes, impacting the availability and reliability of TensorFlow-based applications.

Detailed information about CVE-2022-41884: CWE-670: Always-Incorrect Control Flow Implementation in tensorflow tensorflow affecting tensorflow tensorflow. Get r

CVE-2022-41884: CWE-670: Always-Incorrect Control Flow Implementation in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-41884: CWE-670: Always-Incorrect Control Flow Implementation in tensorflow tensorflow

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.

CVE-2022-31116 is a vulnerability in UltraJSON (ujson), a high-performance JSON encoder and decoder implemented in pure C with Python bindings for versions 3.7 and above. The affected versions prior to 5.4.0 improperly handle JSON strings containing escaped surrogate characters that are not part of valid surrogate pairs. In Unicode, surrogate pairs are used to encode characters outside the Basic Multilingual Plane, and improper handling of lone surrogates can lead to incorrect decoding results. Specifically, ujson versions before 5.4.0 decode these lone surrogates incorrectly, which can corrupt string data and cause key confusion and value overwriting in Python dictionaries. This means that when JSON data from untrusted sources contains such malformed surrogate sequences, the resulting Python dictionary objects may have overwritten or misrepresented keys and values, potentially leading to logic errors, data integrity issues, or security flaws in applications relying on this data. From version 5.4.0 onward, UltraJSON aligns its decoding behavior with Python's standard json module by preserving lone surrogates in the parsed output, mitigating the issue. There are no known workarounds aside from upgrading to the fixed version. The vulnerability is classified under CWE-670, which relates to always-incorrect control flow implementation, indicating a fundamental flaw in how the decoder processes certain input sequences. Although no exploits are currently known in the wild, all users parsing JSON from untrusted sources with affected versions are at risk of data corruption and potential downstream impacts due to this flaw.

Detailed information about CVE-2022-31116: CWE-670: Always-Incorrect Control Flow Implementation in ultrajson ultrajson affecting ultrajson ultrajson. Get real-

CVE-2022-31116: CWE-670: Always-Incorrect Control Flow Implementation in ultrajson ultrajson - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-31116: CWE-670: Always-Incorrect Control Flow Implementation in ultrajson ultrajson

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

CVE-2022-29255 is a vulnerability identified in the Vyper programming language, a Pythonic smart contract language designed for the Ethereum Virtual Machine (EVM). The vulnerability affects versions of Vyper prior to 0.3.4. Specifically, when a smart contract written in Vyper calls an external contract that does not return a value, the contract address and any associated side effects may be evaluated twice due to an incorrect control flow implementation (classified under CWE-670: Always-Incorrect Control Flow Implementation). This double evaluation can lead to unintended behavior in the smart contract, potentially causing incorrect outcomes or logic errors. Since smart contracts often handle financial transactions or critical logic, such an error could result in loss of funds, incorrect state changes, or vulnerabilities exploitable by attackers. The issue was addressed and fixed in version 0.3.4 of Vyper. There are no known exploits in the wild at the time of reporting, and no CVSS score has been assigned to this vulnerability. The problem arises from the way Vyper handles external contract calls without return values, which is a subtle but critical aspect of smart contract execution flow and state management on the Ethereum blockchain.

Detailed information about CVE-2022-29255: CWE-670: Always-Incorrect Control Flow Implementation in vyperlang vyper affecting vyperlang vyper. Get real-time upd

CVE-2022-29255: CWE-670: Always-Incorrect Control Flow Implementation in vyperlang vyper - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-29255: CWE-670: Always-Incorrect Control Flow Implementation in vyperlang vyper

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.

CVE-2022-39354 is a vulnerability identified in SputnikVM, also known as evm, which is a Rust-based implementation of the Ethereum Virtual Machine (EVM). The vulnerability stems from an incorrect handling of the `is_static` parameter within custom stateful precompiles. The `is_static` parameter is intended to indicate whether a call is executed in a static context, specifically when invoked via the `STATICCALL` opcode, which restricts state modifications. Prior to version 0.36.0 of the evm product, the `is_static` parameter was only set to true if the call originated directly from a `STATICCALL` opcode. However, the correct behavior requires that once a static call context is entered, all subsequent calls within that context should also be considered static. This flaw means that custom precompiles relying on the `is_static` parameter could incorrectly perform stateful operations during what should be static calls, leading to improper state transitions within the blockchain environment. The impact is limited to custom precompiles that utilize the `is_static` parameter, and the vulnerability does not affect the core EVM functionality itself. The issue was addressed in version 0.36.0 of the evm product, which corrected the control flow logic to properly propagate the static context. There are no known workarounds for this vulnerability, and no known exploits have been reported in the wild. The vulnerability is classified under CWE-670, which relates to always-incorrect control flow implementation, highlighting the logical error in managing call context state.

Detailed information about CVE-2022-39354: CWE-670: Always-Incorrect Control Flow Implementation in rust-blockchain evm affecting rust-blockchain evm. Get real-

CVE-2022-39354: CWE-670: Always-Incorrect Control Flow Implementation in rust-blockchain evm - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-39354: CWE-670: Always-Incorrect Control Flow Implementation in rust-blockchain evm

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied `validateTransfer` function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers. This issue has been patched as of version `0.2.1`. Users of the Solana Pay SDK should upgrade to it. There are no known workarounds for this issue.

CVE-2022-35917 is a medium-severity vulnerability affecting solana-labs' Solana Pay SDK versions prior to 0.2.1. Solana Pay is a protocol and set of reference implementations designed to facilitate decentralized payments by enabling developers to integrate blockchain-based payment processing into their applications and services. The vulnerability arises from an incorrect control flow implementation (classified under CWE-670) within the `validateTransfer` function, which is responsible for verifying that a transaction located via a reference key corresponds to a transfer of the expected amount to the intended recipient. Due to an edge case in this validation logic, the function may erroneously validate multiple transfers instead of a single, intended transfer. This flaw could potentially allow an attacker to exploit the validation mechanism to bypass intended payment verification, possibly resulting in unauthorized or duplicated transaction acceptance. The issue has been addressed and patched in version 0.2.1 of the Solana Pay SDK. No known exploits have been reported in the wild, and no workarounds exist other than upgrading to the fixed version.

Detailed information about CVE-2022-35917: CWE-670: Always-Incorrect Control Flow Implementation in solana-labs solana-pay affecting solana-labs solana-pay. Get

CVE-2022-35917: CWE-670: Always-Incorrect Control Flow Implementation in solana-labs solana-pay - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-35917: CWE-670: Always-Incorrect Control Flow Implementation in solana-labs solana-pay

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value transferred. It is recommended that an emergency upgrade to be planned and EVM execution temporarily paused in the mean time. The issue is patched in Frontier master branch commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and polkadot-v0.9.22 branch commit e3e427fa2e5d1200a784679f8015d4774cedc934. This vulnerability affects only EVM internal states, but not Substrate balance states or node. You can temporarily pause EVM execution (by setting up a Substrate `CallFilter` that disables `pallet-evm` and `pallet-ethereum` calls before the patch can be applied.

CVE-2022-31111 is a medium-severity vulnerability affecting paritytech's Frontier, which is the Ethereum compatibility layer built on top of the Substrate blockchain framework. The vulnerability arises from an incorrect implementation of truncation logic when converting balances between the Ethereum Virtual Machine (EVM) balance type and the native Substrate balance type. Specifically, the truncation process that should ensure consistent representation of token amounts between these two systems is flawed, resulting in discrepancies between the apparent EVM transfer value and the actual amount transferred on the Substrate layer. This inconsistency can lead to incorrect internal EVM state balances, although the native Substrate balance states and the node itself remain unaffected. The root cause is classified under CWE-670, indicating an always-incorrect control flow implementation, which suggests that the truncation logic consistently fails under all conditions rather than intermittently. The vulnerability was addressed in Frontier's master branch with commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and in the polkadot-v0.9.22 branch with commit e3e427fa2e5d1200a784679f8015d4774cedc934. Until these patches are applied, it is recommended to temporarily pause EVM execution by configuring a Substrate CallFilter to disable calls to the pallet-evm and pallet-ethereum modules, preventing exploitation of the flawed truncation logic. No known exploits have been reported in the wild, and the vulnerability impacts only the internal EVM state, not the underlying Substrate balances or node operations.

Detailed information about CVE-2022-31111: CWE-670: Always-Incorrect Control Flow Implementation in paritytech frontier affecting paritytech frontier. Get real-

CVE-2022-31111: CWE-670: Always-Incorrect Control Flow Implementation in paritytech frontier - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-31111: CWE-670: Always-Incorrect Control Flow Implementation in paritytech frontier

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

CVE-2022-31017 is a logic error vulnerability affecting Zulip, an open-source team collaboration platform widely used for messaging and project coordination. The vulnerability exists in versions 2.1.0 through 5.2 inclusive. Specifically, it concerns private streams configured with protected history, where new subscribers are not supposed to see messages sent before their subscription. However, when an existing message in such a stream is edited, the Zulip server erroneously sends an API event containing the edited message to all current subscribers of the stream, regardless of their subscription time. Official Zulip clients ignore this API event, but it can be observed by attackers or unauthorized users using modified clients or browser developer tools. This results in unintended disclosure of historical messages to users who should not have access, violating the confidentiality principle. The root cause is a logic flaw characterized by an expression that is always true (CWE-571) and incorrect control flow implementation (CWE-670). The issue does not require authentication beyond being a subscriber to the stream, but it does require the ability to observe or intercept API events, which may be possible for insiders or users with elevated access. There are no known workarounds, and the vulnerability is fixed starting with Zulip Server version 5.3. No exploits have been reported in the wild to date.

Detailed information about CVE-2022-31017: CWE-571: Expression is Always True in zulip zulip affecting zulip zulip. Get real-time updates, technical details, an

CVE-2022-31017: CWE-571: Expression is Always True in zulip zulip - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-31017: CWE-571: Expression is Always True in zulip zulip

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

CVE-2022-21655 is a medium-severity vulnerability affecting Envoy, an open-source edge and service proxy widely used in cloud-native application environments. The vulnerability arises from an always-incorrect control flow implementation (CWE-670) in Envoy's common router component. Specifically, when an internal redirect attempts to select a route configured with direct response or redirect actions, the router encounters a segmentation fault (segfault), causing the Envoy process to crash. This behavior leads to a denial of service (DoS) condition, disrupting the availability of services relying on Envoy for routing and proxying. The issue affects multiple versions of Envoy: all versions prior to 1.18.6, versions from 1.19.0 up to but not including 1.19.3, versions from 1.20.0 up to but not including 1.20.2, and versions from 1.21.0 up to but not including 1.21.1. The root cause is a flawed control flow logic that does not correctly handle the combination of internal redirects with routes configured for direct response or redirect actions, leading to an invalid memory access and crash. No known exploits have been reported in the wild as of the published date (February 22, 2022). The recommended workaround is to disable internal redirects on listeners that have direct response entries configured, mitigating the risk until a patched version is deployed. This vulnerability impacts the availability of services but does not directly compromise confidentiality or integrity. Since Envoy is a critical component in many microservices architectures and cloud-native deployments, this DoS can cause significant service disruption if exploited or triggered unintentionally.

Detailed information about CVE-2022-21655: CWE-670: Always-Incorrect Control Flow Implementation in envoyproxy envoy affecting envoyproxy envoy. Get real-time u

CVE-2022-21655: CWE-670: Always-Incorrect Control Flow Implementation in envoyproxy envoy - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-21655: CWE-670: Always-Incorrect Control Flow Implementation in envoyproxy envoy

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.

CVE-2022-21679 is a vulnerability affecting Istio versions 1.12.0 and 1.12.1, which are widely used open-source service mesh platforms designed to connect, manage, and secure microservices. The issue arises from an incorrect implementation of authorization policies involving the 'hosts' and 'notHosts' fields. Specifically, Istio 1.12 introduced support for these fields in authorization policies using a new Envoy API shipped with the 1.12 data plane. However, when the Istio control plane is upgraded to versions 1.12.0 or 1.12.1 while the data plane remains at version 1.11, a mismatch occurs. The control plane uses the new Envoy API, but the older 1.11 data plane does not support it properly. This results in the 'hosts' and 'notHosts' fields being effectively ignored, causing them to always match regardless of the actual host header value. Consequently, authorization policies that rely on these fields may be bypassed or enforced incorrectly. For example, an ALLOW policy might inadvertently permit unauthorized access, or a DENY policy might block legitimate traffic. This flaw is categorized under CWE-670 (Always-Incorrect Control Flow Implementation), indicating a fundamental logic error in how control flow decisions are made during policy enforcement. The vulnerability does not require user interaction or authentication to be exploited but depends on the specific version mismatch between control and data planes. No known exploits have been reported in the wild, and no official patches are linked, though users are advised to avoid mixing control plane 1.12.0/1.12.1 with data plane 1.11 or to upgrade both components to compatible versions. This vulnerability impacts the confidentiality and integrity of microservices communications by potentially allowing unauthorized access or denial of legitimate access within the service mesh environment.

Detailed information about CVE-2022-21679: CWE-670: Always-Incorrect Control Flow Implementation in istio istio affecting istio istio. Get real-time updates, te

CVE-2022-21679: CWE-670: Always-Incorrect Control Flow Implementation in istio istio - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-21679: CWE-670: Always-Incorrect Control Flow Implementation in istio istio

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.

CVE-2025-21607 is a medium-severity vulnerability affecting versions of the Vyper smart contract language prior to 0.4.1. Vyper is a Pythonic language used to write smart contracts for the Ethereum Virtual Machine (EVM). The vulnerability arises from improper control flow handling in the Vyper compiler when invoking two specific EVM precompiled contracts: EcRecover (address 0x1) and Identity (address 0x4). These precompiles are commonly used for cryptographic signature recovery and data copying, respectively. The compiler fails to check the success flag returned by these calls, which indicates whether the precompile executed successfully or failed. An attacker can exploit this by manipulating the gas supplied to these calls, causing them to fail deliberately while allowing the overall contract execution to continue. Due to the EVM's gas forwarding rules, after a failed precompile call, only 1/64 of the original gas remains for subsequent execution, limiting the complexity of any following operations. This gas constraint reduces the practical impact of the vulnerability, as only simple instructions can run after the failure, and no significant real-world contract exploits have been identified. Nonetheless, the flaw represents an incorrect control flow implementation (CWE-670) that could lead to incorrect execution results or logic errors in smart contracts relying on these precompiles. The issue was addressed and fixed in Vyper version 0.4.1. No known exploits are currently reported in the wild, and the advisory is issued as a precautionary measure to encourage updating to the patched version.

Detailed information about CVE-2025-21607: CWE-670: Always-Incorrect Control Flow Implementation in vyperlang vyper affecting vyperlang vyper. Get real-time upd

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-670-always-incorrect-control-flow-implementation'

Filter Threats

Threats Tagged 'cwe-670-always-incorrect-control-flow-implementation'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility