Threats Tagged 'nuget'

CVE-2026-81515 affects SteeltoeOSS versions from 4.0.0 up to but not including 4.3.0. The vulnerability involves improper handling of exceptional conditions during deserialization of registry responses in the EurekaDiscoveryClient component. Malformed data such as unrecognized actionType or status, non-Boolean isCoordinatingDiscoveryServer, or nonnumeric timestamps can cause the entire response to abort. This can lead to all connected Steeltoe clients receiving empty or stale instance lists until the malformed registration is removed. The issue is fixed in version 4.3.0.

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing the exception from one instance to abort construction of the entire instance list and make the targeted service undiscoverable. When GetAllInstancesAsync enumerates all services, one malformed instance can abort enumeration across every service. The outage persists until the offending registration is removed. This issue is fixed in version 4.3.0.

Steeltoe.Security.Authorization.Certificate versions prior to 4.3.0 have an authentication bypass vulnerability. The issue arises because the system trusts the public certificate supplied in the X-Client-Cert header without verifying possession of the corresponding private key. This allows an attacker who can send requests with a spoofed X-Client-Cert header to bypass SameOrg and SameSpace policies if the requests are not restricted to trusted proxy IPs. The vulnerability is fixed in version 4.3.0.

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.

CVE-2026-73851 is a path traversal vulnerability in Microsoft Kiota affecting versions prior to 1.29.1. It allows an attacker controlling the OpenAPI description to supply crafted file references that resolve outside the intended plugin package, potentially causing unauthorized file inclusion or disclosure. Initial mitigations rejected unsafe paths based on raw strings but failed to decode percent-encoded or obfuscated inputs, allowing bypasses. Subsequent fixes decode inputs before validation and reject control characters and Unicode homoglyphs. Users should upgrade to the first release after version 1.33.0 that includes these fixes. Workarounds include generating plugins only from trusted OpenAPI descriptions and reviewing manifests for unsafe file references.

SIPSorcery's TurnServer component has a vulnerability where a malformed UDP datagram with a specific STUN header byte causes an unhandled exception that terminates the UDP receive loop. This results in a denial of service by disabling the TURN UDP relay for all clients until the process is restarted. The issue affects versions from 10.0.5 up to but not including 10.0.14. The vulnerability is pre-authentication and requires no privileges to exploit.

SIPSorcery versions prior to 10.0.14 contain a vulnerability in SCTP SACK chunk parsing where attacker-controlled counts are not validated, leading to out-of-bounds reads. This causes an unhandled IndexOutOfRangeException that terminates the dedicated SCTP receive thread, resulting in a permanent denial of service of the SCTP association and all related data channels.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.