VULN/vuln-cve
1
0
Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-11T21:10:48Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 22:10:53 +01:00
parent af89802205
commit 9598925b15
40 changed files with 14881 additions and 943 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/2024/12xxx/CVE-2024-12740.json
+172 -171
View File
@@ -1,6 +1,6 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-12740",
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
@@ -8,121 +8,26 @@
"assignerShortName": "NI",
"dateReserved": "2024-12-17T20:42:45.704Z",
"datePublished": "2025-01-27T17:17:28.308Z",
"dateUpdated": "2025-01-27T18:52:58.721Z"
"dateUpdated": "2026-11-11T20:12:55.497Z"
},
"containers": {
"cna": {
"affected": [
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2026-11-11T20:12:55.497Z"
},
"title": "Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software",
"problemTypes": [
{
"defaultStatus": "unaffected",
"product": "Vision Development Module",
"vendor": "NI",
"versions": [
"descriptions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
"lang": "en",
"cweId": "CWE-1395",
"description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
"type": "CWE"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexRIO",
"vendor": "NI",
"versions": [
{
"lessThan": "25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NI-IMAQdx",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vision Acquisition Software",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.1",
"status": "affected",
"version": "0",
"versionType": "sem"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vision Builder for Automated Inspection",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Data Record AD",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FRC Game Tools",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.</span><br>"
}
],
"value": "Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file."
}
],
"impacts": [
@@ -136,89 +41,185 @@
]
}
],
"metrics": [
"affected": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
"vendor": "NI",
"product": "Vision Development Module",
"versions": [
{
"lang": "en",
"value": "GENERAL"
"status": "affected",
"version": "0",
"lessThan": "25.0.0",
"versionType": "semver"
}
]
],
"defaultStatus": "unaffected"
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
"vendor": "NI",
"product": "FlexRIO",
"versions": [
{
"lang": "en",
"value": "GENERAL"
"status": "affected",
"version": "0",
"lessThan": "25.0.0",
"versionType": "semver"
}
]
}
],
"problemTypes": [
],
"defaultStatus": "unaffected"
},
{
"descriptions": [
"vendor": "NI",
"product": "NI-IMAQdx",
"versions": [
{
"cweId": "CWE-1395",
"description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
"lang": "en",
"type": "CWE"
"status": "affected",
"version": "0",
"lessThanOrEqual": "23.1.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "Vision Acquisition Software",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "23.1.0",
"versionType": "sem"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "Vision Builder for Automated Inspection",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "24.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "Data Record AD",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "2.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "NI",
"product": "FRC Game Tools",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "25.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Vision-related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>Vision-related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.</span><br>"
}
]
}
],
"providerMetadata": {
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI",
"dateUpdated": "2025-01-27T17:17:28.308Z"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "kimiya working with Trend Micro Zero Day Initiative",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
data/2025/48xxx/CVE-2025-48038.json
+87 -42
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2025-05-15T08:36:04.576Z",
"datePublished": "2025-09-11T08:13:04.030Z",
"dateUpdated": "2026-07-24T14:14:01.613Z"
"dateUpdated": "2026-11-11T19:58:02.263Z"
},
"containers": {
"cna": {
@@ -17,23 +17,61 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.15",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "28.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_sftpd.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "5.3.3",
"at": "5.1.4.12",
"status": "unaffected"
},
{
@@ -41,7 +79,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.12",
"at": "5.3.3",
"status": "unaffected"
}
],
@@ -57,9 +95,9 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
@@ -73,32 +111,12 @@
{
"changes": [
{
"at": "28.0.3",
"at": "f09e0201ff701993dc24a08f15e524daf72db42f",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "26.2.5.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "4e3bf86777ab3db7220c11d8ddabf15970ddd10a",
"status": "unaffected"
},
{
"at": "f09e0201ff701993dc24a08f15e524daf72db42f",
"status": "unaffected"
}
],
"lessThan": "*",
@@ -116,7 +134,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <tt>{subsystems, []}</tt> in the SSH daemon configuration."
"value": "<p>The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <code>{subsystems, []}</code> in the SSH daemon configuration.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting `{subsystems, []}` in the SSH daemon configuration."
}
],
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration."
@@ -130,6 +153,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.15",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -164,6 +188,7 @@
"value": "Ingela Anderton Andin"
}
],
"datePublic": "2025-09-11T08:13:04.000Z",
"descriptions": [
{
"lang": "en",
@@ -171,10 +196,15 @@
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.<p> This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.0.3, OTP&nbsp;27.3.4.3 and OTP&nbsp;26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.</p>"
"value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.15, OTP&nbsp;27.3.4.3, and OTP&nbsp;28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12."
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"impacts": [
@@ -256,10 +286,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:01.613Z"
"dateUpdated": "2026-11-11T19:58:02.263Z"
},
"references": [
{
"name": "SSH Unverified File Handles can Cause Excessive Use of System Resources",
"tags": [
"vendor-advisory",
"related"
@@ -267,18 +298,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r"
},
{
"name": "EEF CNA record for CVE-2025-48038",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2025-48038.html"
},
{
"name": "OSV record EEF-CVE-2025-48038",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-48038"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -291,16 +325,25 @@
"url": "https://github.com/erlang/otp/pull/10156"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"patch"
"related"
],
"url": "https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a"
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit f09e020 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f"
},
{
"name": "Fix commit 4e3bf86 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a"
}
],
"source": {
@@ -314,15 +357,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Disable <tt>sftp</tt></li><li>limiting number of <tt>max_sessions</tt> allowed for <tt>sshd</tt>, so exploiting becomes more complicated</li></ul>"
"value": "<ul>\n<li>Disable <code>sftp</code></li>\n<li>limiting number of <code>max_sessions</code> allowed for <code>sshd</code>, so exploiting becomes more complicated</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Disable `sftp`\n* limiting number of `max_sessions` allowed for `sshd`, so exploiting becomes more complicated"
}
],
"value": "* Disable sftp\n * limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
"value": "* Disable sftp\n* limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2025/48xxx/CVE-2025-48039.json
+87 -42
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2025-05-15T08:36:04.576Z",
"datePublished": "2025-09-11T08:13:36.878Z",
"dateUpdated": "2026-07-24T14:13:56.631Z"
"dateUpdated": "2026-11-11T19:55:51.125Z"
},
"containers": {
"cna": {
@@ -17,23 +17,61 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.15",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "28.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_sftpd.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "5.3.3",
"at": "5.1.4.12",
"status": "unaffected"
},
{
@@ -41,7 +79,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.12",
"at": "5.3.3",
"status": "unaffected"
}
],
@@ -57,9 +95,9 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
@@ -73,32 +111,12 @@
{
"changes": [
{
"at": "28.0.3",
"at": "043ee3c943e2977c1acdd740ad13992fd60b6bf0",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "26.2.5.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "c242e6458967e9514bea351814151695807a54ac",
"status": "unaffected"
},
{
"at": "043ee3c943e2977c1acdd740ad13992fd60b6bf0",
"status": "unaffected"
}
],
"lessThan": "*",
@@ -116,7 +134,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <tt>{subsystems, []}</tt> in the SSH daemon configuration."
"value": "<p>The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <code>{subsystems, []}</code> in the SSH daemon configuration.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting `{subsystems, []}` in the SSH daemon configuration."
}
],
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration."
@@ -130,6 +153,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.15",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -164,6 +188,7 @@
"value": "Ingela Anderton Andin"
}
],
"datePublic": "2025-09-11T08:13:36.000Z",
"descriptions": [
{
"lang": "en",
@@ -171,10 +196,15 @@
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.<p> This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.0.3, OTP&nbsp;27.3.4.3 and OTP&nbsp;26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.</p>"
"value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.15, OTP&nbsp;27.3.4.3, and OTP&nbsp;28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12."
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"impacts": [
@@ -256,10 +286,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:13:56.631Z"
"dateUpdated": "2026-11-11T19:55:51.125Z"
},
"references": [
{
"name": "SSH Unverified Paths can Cause Excessive Use of System Resources",
"tags": [
"vendor-advisory",
"related"
@@ -267,18 +298,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-rr5p-6856-j7h8"
},
{
"name": "EEF CNA record for CVE-2025-48039",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2025-48039.html"
},
{
"name": "OSV record EEF-CVE-2025-48039",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-48039"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -291,16 +325,25 @@
"url": "https://github.com/erlang/otp/pull/10155"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"patch"
"related"
],
"url": "https://github.com/erlang/otp/commit/c242e6458967e9514bea351814151695807a54ac"
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 043ee3c in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/043ee3c943e2977c1acdd740ad13992fd60b6bf0"
},
{
"name": "Fix commit c242e64 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/c242e6458967e9514bea351814151695807a54ac"
}
],
"source": {
@@ -314,15 +357,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Disable <tt>sftp</tt></li><li>limiting number of <tt>max_sessions</tt> allowed for <tt>sshd</tt>, so exploiting becomes more complicated</li></ul>"
"value": "<ul>\n<li>Disable <code>sftp</code></li>\n<li>limiting number of <code>max_sessions</code> allowed for <code>sshd</code>, so exploiting becomes more complicated</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Disable `sftp`\n* limiting number of `max_sessions` allowed for `sshd`, so exploiting becomes more complicated"
}
],
"value": "* Disable sftp\n * limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
"value": "* Disable sftp\n* limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2025/48xxx/CVE-2025-48040.json
+79 -39
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2025-05-15T08:40:25.455Z",
"datePublished": "2025-09-11T08:14:19.671Z",
"dateUpdated": "2026-07-24T14:14:06.640Z"
"dateUpdated": "2026-11-11T19:53:34.489Z"
},
"containers": {
"cna": {
@@ -17,15 +17,53 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.15",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "28.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
"src/ssh_sftpd.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
@@ -33,7 +71,7 @@
{
"changes": [
{
"at": "5.3.3",
"at": "5.1.4.12",
"status": "unaffected"
},
{
@@ -41,7 +79,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.12",
"at": "5.3.3",
"status": "unaffected"
}
],
@@ -57,7 +95,7 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
],
@@ -73,32 +111,12 @@
{
"changes": [
{
"at": "28.0.3",
"at": "548f1295d86d0803da884db8685cc16d461d0d5a",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "26.2.5.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a",
"status": "unaffected"
},
{
"at": "548f1295d86d0803da884db8685cc16d461d0d5a",
"status": "unaffected"
}
],
"lessThan": "*",
@@ -117,6 +135,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.15",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -151,6 +170,7 @@
"value": "Ingela Anderton Andin"
}
],
"datePublic": "2025-09-11T08:14:19.000Z",
"descriptions": [
{
"lang": "en",
@@ -158,10 +178,15 @@
{
"base64": false,
"type": "text/html",
"value": "Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.<p> This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.0.3, OTP&nbsp;27.3.4.3 and OTP&nbsp;26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.</p>"
"value": "<p>Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.15, OTP&nbsp;27.3.4.3, and OTP&nbsp;28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"value": "Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12."
"value": "Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"impacts": [
@@ -243,10 +268,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:06.640Z"
"dateUpdated": "2026-11-11T19:53:34.489Z"
},
"references": [
{
"name": "SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption",
"tags": [
"vendor-advisory",
"related"
@@ -254,18 +280,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph"
},
{
"name": "EEF CNA record for CVE-2025-48040",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2025-48040.html"
},
{
"name": "OSV record EEF-CVE-2025-48040",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-48040"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -278,16 +307,25 @@
"url": "https://github.com/erlang/otp/pull/10162"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"patch"
"related"
],
"url": "https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a"
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 548f129 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a"
},
{
"name": "Fix commit 7cd7abb in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a"
}
],
"source": {
@@ -301,15 +339,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>set option <tt>parallel_login</tt> to <tt>false</tt></li><li>reduce <tt>max_sessions</tt> option</li></ul>"
"value": "<ul>\n<li>set option <code>parallel_login</code> to <code>false</code></li>\n<li>reduce <code>max_sessions</code> option</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* set option `parallel_login` to `false`\n* reduce `max_sessions` option"
}
],
"value": "* set option parallel_login to false\n * reduce max_sessions option"
"value": "* set option parallel_login to false\n* reduce max_sessions option"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2025/48xxx/CVE-2025-48041.json
+87 -42
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2025-05-15T08:40:25.455Z",
"datePublished": "2025-09-11T08:14:20.508Z",
"dateUpdated": "2026-07-24T14:14:04.956Z"
"dateUpdated": "2026-11-11T19:51:38.902Z"
},
"containers": {
"cna": {
@@ -17,23 +17,61 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.15",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "28.0.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_sftpd.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "5.3.3",
"at": "5.1.4.12",
"status": "unaffected"
},
{
@@ -41,7 +79,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.12",
"at": "5.3.3",
"status": "unaffected"
}
],
@@ -57,9 +95,9 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_sftp"
"ssh_sftpd"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
@@ -73,32 +111,12 @@
{
"changes": [
{
"at": "28.0.3",
"at": "d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401",
"status": "unaffected"
},
{
"at": "27.3.4.3",
"status": "unaffected"
},
{
"at": "26.2.5.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "5f9af63eec4657a37663828d206517828cb9f288",
"status": "unaffected"
},
{
"at": "d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401",
"status": "unaffected"
}
],
"lessThan": "*",
@@ -116,7 +134,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <tt>{subsystems, []}</tt> in the SSH daemon configuration."
"value": "<p>The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting <code>{subsystems, []}</code> in the SSH daemon configuration.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting `{subsystems, []}` in the SSH daemon configuration."
}
],
"value": "The SFTP subsystem must be enabled on the SSH server and the SSH port must be reachable by the attacker. SFTP is enabled by default unless explicitly disabled by setting {subsystems, []} in the SSH daemon configuration."
@@ -130,6 +153,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.15",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -164,6 +188,7 @@
"value": "Ingela Anderton Andin"
}
],
"datePublic": "2025-09-11T08:14:20.000Z",
"descriptions": [
{
"lang": "en",
@@ -171,10 +196,15 @@
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.<p> This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.0.3, OTP&nbsp;27.3.4.3 and OTP&nbsp;26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12.</p>"
"value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.15, OTP&nbsp;27.3.4.3, and OTP&nbsp;28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.3, OTP 27.3.4.3 and OTP 26.2.5.15, corresponding to ssh from 3.0.1 before 5.3.3, 5.2.11.3 and 5.1.4.12."
"value": "Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.15, OTP 27.3.4.3, and OTP 28.0.3, corresponding to ssh from 3.0.1 before 5.1.4.12, 5.2.11.3, and 5.3.3."
}
],
"impacts": [
@@ -256,10 +286,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:04.956Z"
"dateUpdated": "2026-11-11T19:51:38.902Z"
},
"references": [
{
"name": "SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles",
"tags": [
"vendor-advisory",
"related"
@@ -267,18 +298,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3"
},
{
"name": "EEF CNA record for CVE-2025-48041",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2025-48041.html"
},
{
"name": "OSV record EEF-CVE-2025-48041",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-48041"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -291,16 +325,25 @@
"url": "https://github.com/erlang/otp/pull/10157"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"patch"
"related"
],
"url": "https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288"
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit d49efa2 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401"
},
{
"name": "Fix commit 5f9af63 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288"
}
],
"source": {
@@ -314,15 +357,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>disabling SFTP<tt></tt></li><li>limiting number of <tt>max_sessions</tt> allowed for <tt>sshd</tt>, so exploiting becomes more complicated</li></ul>"
"value": "<ul>\n<li>disabling SFTP</li>\n<li>limiting number of <code>max_sessions</code> allowed for <code>sshd</code>, so exploiting becomes more complicated</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* disabling SFTP\n* limiting number of `max_sessions` allowed for `sshd`, so exploiting becomes more complicated"
}
],
"value": "* disabling SFTP\n * limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
"value": "* disabling SFTP\n* limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2025/4xxx/CVE-2025-4748.json
+99 -44
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2025-05-15T08:36:54.783Z",
"datePublished": "2025-06-16T11:00:54.643Z",
"dateUpdated": "2026-07-24T14:13:54.963Z"
"dateUpdated": "2026-11-11T20:04:45.959Z"
},
"containers": {
"cna": {
@@ -17,12 +17,12 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"stdlib"
"zip"
],
"packageName": "stdlib",
"packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/stdlib/src/zip.erl"
@@ -41,13 +41,65 @@
"name": "zip:extract/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.13",
"status": "unaffected"
},
{
"at": "27.3.4.1",
"status": "unaffected"
},
{
"at": "28.0.1",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"zip"
],
"packageName": "stdlib",
"packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "7.0.1",
"at": "5.2.3.4",
"status": "unaffected"
},
{
@@ -55,7 +107,7 @@
"status": "unaffected"
},
{
"at": "5.2.3.4",
"at": "7.0.1",
"status": "unaffected"
}
],
@@ -71,9 +123,9 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"stdlib"
"zip"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
@@ -101,35 +153,15 @@
{
"changes": [
{
"at": "28.0.1",
"at": "578d4001575aa7647ea1efd4b2b7e3afadcc99a5",
"status": "unaffected"
},
{
"at": "27.3.4.1",
"at": "ba2f2bc5f45fcfd2d6201ba07990a678bbf4cc8f",
"status": "unaffected"
},
{
"at": "26.2.5.13",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "d9454dbccbaaad4b8796095c8e653b71b066dfaf",
"status": "unaffected"
},
{
"at": "9b7b5431260e05a16eec3ecd530a232d0995d932",
"status": "unaffected"
},
{
"at": "0ac548b57c0491196c27e39518b5f6acf9326c1e",
"at": "5a55feec10c9b69189d56723d8f237afa58d5d4f",
"status": "unaffected"
}
],
@@ -149,6 +181,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.13",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -188,6 +221,7 @@
"value": "Björn Gustavsson"
}
],
"datePublic": "2025-06-16T11:00:54.000Z",
"descriptions": [
{
"lang": "en",
@@ -195,10 +229,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.<p> This vulnerability is associated with program files <tt>lib/stdlib/src/zip.erl</tt> and program routines <tt>zip:unzip/1</tt>, <tt>zip:unzip/2</tt>, <tt>zip:extract/1</tt>, <tt>zip:extract/2</tt><tt>&nbsp;</tt><span style=\"background-color: rgb(255, 255, 255);\">unless the <tt>memory</tt> option is passed.</span></p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.0.1, OTP&nbsp;27.3.4.1 and OTP&nbsp;26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4.</p>"
"value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.</p>\n<p>This vulnerability is associated with program files <code>lib/stdlib/src/zip.erl</code> and program routines <code>zip:unzip/1</code>, <code>zip:unzip/2</code>, <code>zip:extract/1</code>, <code>zip:extract/2</code> unless the <code>memory</code> option is passed.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.13, OTP&nbsp;27.3.4.1, and OTP&nbsp;28.0.1, corresponding to stdlib from 2.0 before 5.2.3.4, 6.2.2.1, and 7.0.1.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.\n\nThis vulnerability is associated with program files `lib/stdlib/src/zip.erl` and program routines `zip:unzip/1`, `zip:unzip/2`, `zip:extract/1`, `zip:extract/2` unless the `memory` option is passed.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.13, OTP 27.3.4.1, and OTP 28.0.1, corresponding to stdlib from 2.0 before 5.2.3.4, 6.2.2.1, and 7.0.1."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 before 7.0.1, 6.2.2.1 and 5.2.3.4."
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation.\n\nThis vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.13, OTP 27.3.4.1, and OTP 28.0.1, corresponding to stdlib from 2.0 before 5.2.3.4, 6.2.2.1, and 7.0.1."
}
],
"impacts": [
@@ -260,7 +299,7 @@
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
@@ -270,10 +309,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:13:54.963Z"
"dateUpdated": "2026-11-11T20:04:45.959Z"
},
"references": [
{
"name": "Absolute Path in Zip Module",
"tags": [
"vendor-advisory",
"related"
@@ -281,18 +321,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc"
},
{
"name": "EEF CNA record for CVE-2025-4748",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2025-4748.html"
},
{
"name": "OSV record EEF-CVE-2025-4748",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-4748"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -305,22 +348,32 @@
"url": "https://github.com/erlang/otp/pull/9941"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 578d400 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4f"
"url": "https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5"
},
{
"name": "Fix commit ba2f2bc in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/ba2f2bc5f45fcfd2d6201ba07990a678bbf4cc8f"
},
{
"name": "Fix commit 5a55fee in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5"
"url": "https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4f"
}
],
"source": {
@@ -334,15 +387,17 @@
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">You can use </span><code>zip:list_dir/1</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;on the archive and verify that no files contain absolute paths before extracting the archive to disk.</span><br>"
"value": "<p>You can use <code>zip:list_dir/1</code> on the archive and verify that no files contain absolute paths before extracting the archive to disk.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "You can use `zip:list_dir/1` on the archive and verify that no files contain absolute paths before extracting the archive to disk."
}
],
"value": "You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk."
"value": "You can use zip:list_dir/1 on the archive and verify that no files contain absolute paths before extracting the archive to disk."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/0xxx/CVE-2026-0323.json
+225
View File
@@ -0,0 +1,225 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0323",
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"state": "PUBLISHED",
"assignerShortName": "palo_alto",
"dateReserved": "2025-11-03T20:46:25.117Z",
"datePublished": "2026-11-11T20:03:37.104Z",
"dateUpdated": "2026-11-11T20:03:37.104Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto",
"dateUpdated": "2026-11-11T20:03:37.104Z"
},
"title": "Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability",
"datePublic": "2026-11-11T17:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"affected": [
{
"vendor": "Palo Alto Networks",
"product": "Checkov by Prisma Cloud",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.4.2",
"changes": [
{
"at": "3.4.2",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.4.2",
"versionStartIncluding": "3.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"value": "A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.<br></p>"
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0323",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "LOW",
"baseScore": 1.1,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"
}
}
],
"configurations": [
{
"lang": "eng",
"value": "This issue is only applicable to Checkov deployments configured to download external Terraform modules and scanning Terraform configurations from untrusted sources.\n\nTo check if a Checkov deployment has external module downloading enabled:\n\n\n\n 1. Check for the --download-external-modules true from command-line option (https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html#:~:text=Download%20external%20terraform%20modules%20from%20public%20git%20repositories%20and%20terraform%20registry%20%5Benv%20var%3ADOWNLOAD_EXTERNAL_MODULES%5D). (https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html#:~:text=Download%20external%20terraform%20modules%20from%20public%20git%20repositories%20and%20terraform%20registry%20%5Benv%20var%3ADOWNLOAD_EXTERNAL_MODULES%5D)\n 2. Check your Checkov configuration files for download-external-modules: true.\n\n\n\nIf any of these settings are present, your deployment is affected",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>This issue is only applicable to Checkov deployments configured to download external Terraform modules and scanning Terraform configurations from untrusted sources. </p><p>To check if a Checkov deployment has external module downloading enabled:</p><p></p><ol><li>Check for the --download-external-modules true <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html#:~:text=Download%20external%20terraform%20modules%20from%20public%20git%20repositories%20and%20terraform%20registry%20%5Benv%20var%3ADOWNLOAD_EXTERNAL_MODULES%5D\">from command-line option</a><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html#:~:text=Download%20external%20terraform%20modules%20from%20public%20git%20repositories%20and%20terraform%20registry%20%5Benv%20var%3ADOWNLOAD_EXTERNAL_MODULES%5D\">.</a></li><li>Check your Checkov configuration files for download-external-modules: true.</li></ol><p></p><p>If any of these settings are present, your deployment is affected<br></p>"
}
]
}
],
"workarounds": [
{
"lang": "eng",
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory."
}
]
}
],
"solutions": [
{
"lang": "eng",
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCheckov by Prisma Cloud 2.0.1018 through 3.4.1 Upgrade to 3.4.2 or later.\n\n\nCheckov integration in Prisma Cloud is upgraded automatically when new versions become available.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>&nbsp;Minor Version&nbsp;</th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Checkov by Prisma Cloud&nbsp;</td><td>&nbsp;2.0.1018&nbsp;through 3.4.1</td><td>Upgrade to 3.4.2 or later.</td></tr></tbody></table><br>Checkov integration in Prisma Cloud is upgraded automatically when new versions become available."
}
]
}
],
"exploits": [
{
"lang": "en",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
]
}
],
"timeline": [
{
"time": "2026-11-11T17:00:00.000Z",
"lang": "en",
"value": "Initial publication."
}
],
"credits": [
{
"lang": "en",
"value": "James Golovich",
"type": "finder"
},
{
"lang": "en",
"value": "Sreejith Gopinath",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"x_affectedList": [
"Checkov by Prisma Cloud 3.4.0",
"Checkov by Prisma Cloud 3.4.1"
],
"x_cpeGeneratedAt": "2026-11-11T20:03:00.157Z"
}
}
}
data/2026/0xxx/CVE-2026-0324.json
+5043
View File
File diff suppressed because it is too large Load Diff
data/2026/0xxx/CVE-2026-0325.json
+642
View File
@@ -0,0 +1,642 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0325",
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"state": "PUBLISHED",
"assignerShortName": "palo_alto",
"dateReserved": "2025-11-03T20:46:27.343Z",
"datePublished": "2026-11-11T19:51:55.386Z",
"dateUpdated": "2026-11-11T19:51:55.386Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto",
"dateUpdated": "2026-11-11T19:51:55.386Z"
},
"title": "PAN-OS: GlobalProtect Authorization Bypass Vulnerability",
"datePublic": "2026-11-11T17:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-940",
"description": "CWE-940 Improper Verification of Source of a Communication Channel",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"affected": [
{
"vendor": "Palo Alto Networks",
"product": "Cloud NGFW",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"versions": [
{
"status": "affected",
"version": "12.2.0",
"lessThan": "12.2.4-h2",
"changes": [
{
"at": "12.2.4-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "12.1.0",
"lessThan": "12.1.10-h4",
"changes": [
{
"at": "12.1.10-h4",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.2.0",
"lessThan": "11.2.16-h2",
"changes": [
{
"at": "11.2.16-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.1.0",
"lessThan": "11.1.16-h5",
"changes": [
{
"at": "11.1.16-h5",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access",
"versions": [
{
"status": "affected",
"version": "12.1.0",
"lessThan": "12.1.10-h4",
"changes": [
{
"at": "12.1.10-h4",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
}
],
"defaultStatus": "affected"
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.4-h2",
"versionStartIncluding": "12.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10-h4",
"versionStartIncluding": "12.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.16-h2",
"versionStartIncluding": "11.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h5",
"versionStartIncluding": "11.1.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10-h4",
"versionStartIncluding": "12.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"value": "An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.\n\nCloud NGFW is not affected by this vulnerability.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.</span><b><span><br></span><span><br></span></b><span>Cloud NGFW is not affected by this vulnerability.</span>"
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0325",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "LOW",
"baseScore": 1.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber"
}
}
],
"configurations": [
{
"lang": "eng",
"value": "This issue is applicable only to PAN-OS firewall configurations with a GlobalProtect gateway enabled. You can verify whether you have a GlobalProtect gateway configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<span>This issue is applicable only to PAN-OS firewall configurations with a GlobalProtect gateway enabled. You can verify whether you have a GlobalProtect gateway configured by checking for entries in your firewall web interface (</span><span><b>Network</b></span><span> &gt; </span><span><b>GlobalProtect</b></span><span> &gt; </span><span><b>Gateways</b></span><span>).</span>"
}
]
}
],
"workarounds": [
{
"lang": "eng",
"value": "You can reduce exposure to this vulnerability by limiting access to GlobalProtect services using DoS protection policies, country-based access restrictions, and IP blocklists. For detailed configuration guidance, see: How to limit unnecessary exposure to the internet (for GlobalProtect and other services) (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008XtYCAU).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>You can reduce exposure to this vulnerability by limiting access to GlobalProtect services using DoS protection policies, country-based access restrictions, and IP blocklists. For detailed configuration guidance, see: <a target=\"_blank\" rel=\"nofollow\" href=\"https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008XtYCAU\">How to limit unnecessary exposure to the internet (for GlobalProtect and other services)</a>.</p>"
}
]
}
],
"solutions": [
{
"lang": "eng",
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW No action needed.\nPAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later.\nPAN-OS 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h4 or later.\nPAN-OS 11.2 11.2.0 through 11.2.16-h* Upgrade to 11.2.16-h2 or later.\nPAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h5 or later.\nAll older Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access 12.1 12.1.2 through 12.1.10-4* Upgrade to 12.1.10-h4 or later.\nPrisma Access 11.2 Upgrade to 12.1.10-h4 or later.\n\n\n* See the note under Product Status for information regarding Prisma Access upgrades.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Cloud NGFW<br></td><td></td><td>No action needed.</td></tr><tr>\n <td>PAN-OS 12.2<br></td>\n <td>12.2.0 through 12.2.4-h*</td>\n <td>Upgrade to 12.2.4-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 12.1<br></td>\n <td>12.1.2 through 12.1.10-h*</td>\n <td>Upgrade to 12.1.10-h4 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.2<br></td>\n <td>11.2.0 through 11.2.16-h*</td>\n <td>Upgrade to 11.2.16-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.1<br></td>\n <td>11.1.0 through 11.1.16-h*</td>\n <td>Upgrade to 11.1.16-h5 or later.</td>\n </tr><tr><td>All older<br>unsupported<br>PAN-OS versions</td><td>&nbsp;</td><td>Upgrade to a supported fixed version.</td></tr><tr><td>Prisma Access 12.1</td><td>12.1.2 through 12.1.10-4*</td><td>Upgrade to 12.1.10-h4 or later.<br></td></tr><tr><td>Prisma Access 11.2</td><td><br></td><td>Upgrade to 12.1.10-h4 or later.</td></tr></tbody></table><br>* See the note under Product Status for information regarding Prisma Access upgrades."
}
]
}
],
"exploits": [
{
"lang": "en",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
]
}
],
"timeline": [
{
"time": "2026-11-11T17:00:00.000Z",
"lang": "en",
"value": "Initial publication"
}
],
"credits": [
{
"lang": "en",
"value": "internal security research teams",
"type": "finder"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"x_affectedList": [
"PAN-OS 12.2.4-h1",
"PAN-OS 12.2.4",
"PAN-OS 12.2.3",
"PAN-OS 12.2.2",
"PAN-OS 12.1.10-h3",
"PAN-OS 12.1.10-h2",
"PAN-OS 12.1.10",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h12",
"PAN-OS 12.1.7-h11",
"PAN-OS 12.1.7-h9",
"PAN-OS 12.1.7-h8",
"PAN-OS 12.1.7-h6",
"PAN-OS 12.1.7-h5",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h14",
"PAN-OS 12.1.4-h13",
"PAN-OS 12.1.4-h12",
"PAN-OS 12.1.4-h11",
"PAN-OS 12.1.4-h10",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.16-h1",
"PAN-OS 11.2.16",
"PAN-OS 11.2.15",
"PAN-OS 11.2.13-h4",
"PAN-OS 11.2.13-h3",
"PAN-OS 11.2.13-h2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h17",
"PAN-OS 11.2.10-h16",
"PAN-OS 11.2.10-h15",
"PAN-OS 11.2.10-h14",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h23",
"PAN-OS 11.2.7-h21",
"PAN-OS 11.2.7-h20",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h24",
"PAN-OS 11.2.4-h23",
"PAN-OS 11.2.4-h22",
"PAN-OS 11.2.4-h21",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h4",
"PAN-OS 11.1.16-h3",
"PAN-OS 11.1.16-h2",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h16",
"PAN-OS 11.1.13-h15",
"PAN-OS 11.1.13-h12",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h36",
"PAN-OS 11.1.10-h35",
"PAN-OS 11.1.10-h33",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h41",
"PAN-OS 11.1.6-h40",
"PAN-OS 11.1.6-h39",
"PAN-OS 11.1.6-h38",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h39",
"PAN-OS 11.1.4-h38",
"PAN-OS 11.1.4-h37",
"PAN-OS 11.1.4-h36",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0"
],
"x_cpeGeneratedAt": "2026-11-11T19:51:00.512Z"
}
}
}
data/2026/0xxx/CVE-2026-0326.json
+634
View File
@@ -0,0 +1,634 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0326",
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"state": "PUBLISHED",
"assignerShortName": "palo_alto",
"dateReserved": "2025-11-03T20:46:28.340Z",
"datePublished": "2026-11-11T19:50:29.708Z",
"dateUpdated": "2026-11-11T19:50:29.708Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto",
"dateUpdated": "2026-11-11T19:50:29.708Z"
},
"title": "PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing",
"datePublic": "2026-11-11T17:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "Palo Alto Networks",
"product": "Cloud NGFW",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"versions": [
{
"status": "affected",
"version": "12.2.0",
"lessThan": "12.2.4-h2",
"changes": [
{
"at": "12.2.4-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "12.1.0",
"lessThan": "12.1.10-h4",
"changes": [
{
"at": "12.1.10-h4",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.2.0",
"lessThan": "11.2.16-h2",
"changes": [
{
"at": "11.2.16-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.1.0",
"lessThan": "11.1.16-h5",
"changes": [
{
"at": "11.1.16-h5",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:*:*:*",
"versionStartIncluding": "all",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.4-h2",
"versionStartIncluding": "12.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10-h4",
"versionStartIncluding": "12.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.16-h2",
"versionStartIncluding": "11.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h5",
"versionStartIncluding": "11.1.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.\n\n\n\nPanorama and Prisma® Access are not affected by this vulnerability.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p></p><p><span>A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.</span></p><p><span>Panorama and Prisma® Access are not affected by this vulnerability.</span></p><p></p>"
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0326",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "LOW",
"baseScore": 1.7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"
}
}
],
"configurations": [
{
"lang": "eng",
"value": "Customers are impacted if the following conditions are true:\n\n 1. SCTP is enabled or\n\n 2. DNS proxy object is configured and enabled on the firewall or\n\n 3. OSPFv3 routing on an IPv6 interface is enabled.\n\nTo check if SCTP is enabled: \n\n * Navigate to Device > Setup > Management (https://docs.paloaltonetworks.com/ngfw/help/10-2/device/device-setup-management) > General Settings and check if SCTP Security (https://docs.paloaltonetworks.com/service-providers/10-2/mobile-network-infrastructure-getting-started/sctp/configure-sctp-security) is checked.\n \n * Navigate to Policies > Security (https://docs.paloaltonetworks.com/ngfw/help/10-2/policies/policies-security), inspect your active policy rules, and verify if an SCTP Protection profile (https://docs.paloaltonetworks.com/ngfw/help/10-1/objects/objects-security-profiles-sctp-protection) is applied under the rule's Actions tab to a rule allowing SCTP traffic.\n\nVerify DNS Proxy Status:\n\n * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).\n \n * Review all configured DNS Proxy objects.\n \n * Click to open each DNS Proxy object and verify whether the Enable checkbox is selected.\n\nVerify OSPFv3 routing on IPv6\n\n * Navigate to Network > Virtual Routers (https://docs.paloaltonetworks.com/ngfw/help/10-2/network/network-virtual-routers) (or Advanced Routing (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing)), open your active virtual router, and check under OSPFv3 (https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3) to confirm if OSPFv3 routing is enabled on any IPv6 interface or subinterface.\n\n * Navigate to Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles) (or view the profile attached to the OSPFv3 area/interface). Inspect the SPI configuration (https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3) to see if: ESP Authentication is set to NONE.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Customers are impacted if the following conditions are true:</p><ol><li><p>SCTP is enabled&nbsp;<b>or</b></p></li><li><p>DNS proxy object is configured and enabled on the firewall&nbsp;<b>or</b></p></li><li><p>OSPFv3 routing on an IPv6 interface is enabled.</p></li></ol><div>To check if SCTP is enabled:&nbsp;<br><ul><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/device/device-setup-management\">Device &gt; Setup &gt; Management</a> &gt; General Settings and check if <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/service-providers/10-2/mobile-network-infrastructure-getting-started/sctp/configure-sctp-security\">SCTP Security</a> is checked.<br></li><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/policies/policies-security\">Policies &gt; Security</a>, inspect your active policy rules, and verify if an <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-1/objects/objects-security-profiles-sctp-protection\">SCTP Protection profile</a> is applied under the rule's Actions tab to a rule allowing SCTP traffic.</li></ul>Verify DNS Proxy Status:<br><ul><li>Navigate to Network &gt; <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy\">DNS Proxy</a>.<br></li><li>Review all configured DNS Proxy objects.<br></li><li>Click to open each DNS Proxy object and verify whether the <b>Enable</b> checkbox is selected.</li></ul>Verify OSPFv3 routing on IPv6<br><ul><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/network/network-virtual-routers\">Network &gt; Virtual Routers</a> (or <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing\">Advanced Routing</a>), open your active virtual router, and check under <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3\">OSPFv3</a> to confirm if OSPFv3 routing is enabled on any IPv6 interface or subinterface.</li><li><p>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles\">Network &gt; Network Profiles &gt; OSPFv3 Auth</a> (or view the profile attached to the OSPFv3 area/interface). Inspect the <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3\">SPI configuration</a> to see if:&nbsp;ESP Authentication is set to NONE.</p></li></ul></div><b></b>"
}
]
}
],
"workarounds": [
{
"lang": "eng",
"value": "Customers can mitigate the risk of this issue by taking the following actions.\n\nDetach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.\n\nDisable configured DNS proxy objects:\n\n * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).\n\n * Click on each configured DNS Proxy object.\n\n * Uncheck the Enable checkbox.\n\n * Click OK and Commit the changes.\n\nUpdate any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles) to use standard cryptographic authentication other than ESP-NULL.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Customers can mitigate the risk of this issue by taking the following actions.</p><p>Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.</p><p>Disable configured DNS proxy objects:</p><ul><li><p>Navigate to&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy\">Network &gt; DNS Proxy</a>.</p></li></ul><ul><li><p>Click on each configured DNS Proxy object.</p></li></ul><ul><li><p>Uncheck the&nbsp;<b>Enable</b>&nbsp;checkbox.</p></li></ul><ul><li><p>Click&nbsp;<b>OK</b>&nbsp;and <b>C</b><b>ommit</b>&nbsp;the changes.</p></li></ul><p>Update any active OSPFv3 Auth Profiles under&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles\">Network &gt; Network Profiles &gt; OSPFv3 Auth</a>&nbsp; to use standard cryptographic authentication other than ESP-NULL.<br></p>"
}
]
}
],
"solutions": [
{
"lang": "eng",
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW Customers who prefer to upgrade can work with Palo Alto\n Networks support to schedule an on-demand software upgrade.\nPAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later.\nPAN-OS 12.1 12.1.0 through 12.1.10-h* Upgrade to 12.1.10-h4 or later.\nPAN-OS 11.2 11.2.0 through 11.2.16-h* Upgrade to 11.2.16-h2 or later.\nPAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h5 or later.\nAll older Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access No action needed.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Cloud NGFW</td><td></td><td>Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade.</td></tr><tr>\n <td>PAN-OS 12.2<br></td>\n <td>12.2.0 through 12.2.4-h*</td>\n <td>Upgrade to 12.2.4-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 12.1<br></td>\n <td>12.1.0 through 12.1.10-h*</td>\n <td>Upgrade to 12.1.10-h4 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.2<br></td>\n <td>11.2.0 through 11.2.16-h*</td>\n <td>Upgrade to 11.2.16-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.1<br></td>\n <td>11.1.0 through 11.1.16-h*</td>\n <td>Upgrade to 11.1.16-h5 or later.</td>\n </tr><tr><td>All older<br>unsupported<br>PAN-OS versions</td><td>&nbsp;</td><td>Upgrade to a supported fixed version.</td></tr><tr><td>Prisma Access<br></td><td></td><td>No action needed.</td></tr></tbody></table>"
}
]
}
],
"exploits": [
{
"lang": "en",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
]
}
],
"timeline": [
{
"time": "2026-11-11T17:00:00.000Z",
"lang": "en",
"value": "Initial Publication"
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI",
"type": "finder"
},
{
"lang": "en",
"value": "Rotem Bar (internal reporter)",
"type": "finder"
},
{
"lang": "en",
"value": "Ben Nott (internal reporter)",
"type": "finder"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"x_affectedList": [
"PAN-OS 12.2.4-h1",
"PAN-OS 12.2.4",
"PAN-OS 12.2.3",
"PAN-OS 12.2.2",
"PAN-OS 12.1.10-h3",
"PAN-OS 12.1.10-h2",
"PAN-OS 12.1.10",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h12",
"PAN-OS 12.1.7-h11",
"PAN-OS 12.1.7-h9",
"PAN-OS 12.1.7-h8",
"PAN-OS 12.1.7-h6",
"PAN-OS 12.1.7-h5",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h14",
"PAN-OS 12.1.4-h13",
"PAN-OS 12.1.4-h12",
"PAN-OS 12.1.4-h11",
"PAN-OS 12.1.4-h10",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.16-h1",
"PAN-OS 11.2.16",
"PAN-OS 11.2.15",
"PAN-OS 11.2.13-h4",
"PAN-OS 11.2.13-h3",
"PAN-OS 11.2.13-h2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h17",
"PAN-OS 11.2.10-h16",
"PAN-OS 11.2.10-h15",
"PAN-OS 11.2.10-h14",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h23",
"PAN-OS 11.2.7-h21",
"PAN-OS 11.2.7-h20",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h24",
"PAN-OS 11.2.4-h23",
"PAN-OS 11.2.4-h22",
"PAN-OS 11.2.4-h21",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h4",
"PAN-OS 11.1.16-h3",
"PAN-OS 11.1.16-h2",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h16",
"PAN-OS 11.1.13-h15",
"PAN-OS 11.1.13-h12",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h36",
"PAN-OS 11.1.10-h35",
"PAN-OS 11.1.10-h33",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h41",
"PAN-OS 11.1.6-h40",
"PAN-OS 11.1.6-h39",
"PAN-OS 11.1.6-h38",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h39",
"PAN-OS 11.1.4-h38",
"PAN-OS 11.1.4-h37",
"PAN-OS 11.1.4-h36",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0"
],
"x_cpeGeneratedAt": "2026-11-11T19:48:58.606Z"
}
}
}
data/2026/0xxx/CVE-2026-0327.json
+642
View File
@@ -0,0 +1,642 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-0327",
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"state": "PUBLISHED",
"assignerShortName": "palo_alto",
"dateReserved": "2025-11-03T20:46:29.314Z",
"datePublished": "2026-11-11T19:48:39.698Z",
"dateUpdated": "2026-11-11T19:48:39.698Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto",
"dateUpdated": "2026-11-11T19:48:39.698Z"
},
"title": "PAN-OS: Privilege Escalation Vulnerability in GlobalProtect",
"datePublic": "2026-11-11T17:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"affected": [
{
"vendor": "Palo Alto Networks",
"product": "Cloud NGFW",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Palo Alto Networks",
"product": "PAN-OS",
"versions": [
{
"status": "affected",
"version": "12.2.0",
"lessThan": "12.2.4-h2",
"changes": [
{
"at": "12.2.4-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "12.1.0",
"lessThan": "12.1.10-h4",
"changes": [
{
"at": "12.1.10-h4",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.2.0",
"lessThan": "11.2.16-h2",
"changes": [
{
"at": "11.2.16-h2",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.1.0",
"lessThan": "11.1.16-h5",
"changes": [
{
"at": "11.1.16-h5",
"status": "unaffected"
}
],
"versionType": "custom"
}
],
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access",
"versions": [
{
"status": "affected",
"version": "12.1.0",
"lessThan": "12.1.10-h4",
"changes": [
{
"at": "12.1.10-h4",
"status": "unaffected"
}
],
"versionType": "custom"
},
{
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.4-h2",
"versionStartIncluding": "12.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10-h4",
"versionStartIncluding": "12.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.16-h2",
"versionStartIncluding": "11.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h5",
"versionStartIncluding": "11.1.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10-h4",
"versionStartIncluding": "12.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.\n\n\n\nCloud NGFW and Panorama are not affected by this vulnerability.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p><span>A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.</span></p><p><span>Cloud NGFW and Panorama are not affected by this vulnerability.</span></p>"
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0327",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "LOW",
"baseScore": 2.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"
}
}
],
"configurations": [
{
"lang": "eng",
"value": "This issue affects firewalls with GlobalProtect gateway configured when an authentication profile utilizes a RADIUS provider and issues a supported authentication challenge.\n\nTo check if a GlobalProtect Gateway is using a RADIUS authentication profile, follow these steps:\n\n 1. Navigate to Network > GlobalProtect > Gateways (https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways) in the management interface.\n 2. Click on your Gateway Name and go to the Authentication tab.\n 3. Review the Client Authentication configuration to identify the associated Authentication Profile.\n 4. Navigate to Device > Authentication Profile (https://www.google.com/search?q=https://docs.paloaltonetworks.com/ngfw/help/11-1/device/device-authentication-profile) to check if the profile references a RADIUS Server Profile (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-radius-authentication).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "This issue affects firewalls with GlobalProtect gateway configured when an authentication profile utilizes a RADIUS provider and issues a supported authentication challenge.<br><br>To check if a GlobalProtect Gateway is using a RADIUS authentication profile, follow these steps:<br><ol><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways\">Network &gt; GlobalProtect &gt; Gateways</a> in the management interface.</li><li>Click on your Gateway Name and go to the <b>Authentication</b> tab.</li><li>Review the <b>Client Authentication</b> configuration to identify the associated <b>Authentication Profile</b>.</li><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.google.com/search?q=https://docs.paloaltonetworks.com/ngfw/help/11-1/device/device-authentication-profile\">Device &gt; Authentication Profile</a> to check if the profile references a <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-radius-authentication\">RADIUS Server Profile</a>.</li></ol>"
}
]
}
],
"workarounds": [
{
"lang": "eng",
"value": "Customers can mitigate the risk of this issue by taking the following actions:\n\n 1. Navigate to Network > GlobalProtect > Gateways (https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways) in the management interface.\n 2. Click on your Gateway Name and go to the Authentication tab.\n 3. Under Client Authentication, select your existing client authentication configuration.\n 4. Change the Authentication Profile to a non-challenge profile (such as SAML), or assign a Certificate Profile to enforce client certificate authentication.\n 5. Click OK and Commit the changes.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Customers can mitigate the risk of this issue by taking the following actions:<br><ol><li>Navigate to <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways\">Network &gt; GlobalProtect &gt; Gateways</a> in the management interface.</li><li>Click on your Gateway Name and go to the <b>Authentication</b> tab.</li><li>Under <b>Client Authentication</b>, select your existing client authentication configuration.</li><li>Change the <b>Authentication Profile</b> to a non-challenge profile (such as SAML), or assign a <b>Certificate Profile</b> to enforce client certificate authentication.</li><li>Click <b>OK</b> and <b>Commit</b> the changes.</li></ol>"
}
]
}
],
"solutions": [
{
"lang": "eng",
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW No action needed.\nPAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later.\nPAN-OS 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h4 or later.\nPAN-OS 11.2 11.2.0 through 11.2.16-h* Upgrade to 11.2.16-h2 or later.\nPAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h5 or later.\nAll older Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h4 or later.\nPrisma Access 11.2 Upgrade to 12.1.10-h4 or later. \n\n\n* See the note under Product Status for information regarding Prisma Access upgrades.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Cloud NGFW<br></td><td></td><td>No action needed.</td></tr><tr>\n <td>PAN-OS 12.2<br></td>\n <td>12.2.0 through 12.2.4-h*</td>\n <td>Upgrade to 12.2.4-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 12.1<br></td>\n <td>12.1.2 through 12.1.10-h*</td>\n <td>Upgrade to 12.1.10-h4 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.2<br></td>\n <td>11.2.0 through 11.2.16-h*</td>\n <td>Upgrade to 11.2.16-h2 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.1<br></td>\n <td>11.1.0 through 11.1.16-h*</td>\n <td>Upgrade to 11.1.16-h5 or later.</td>\n </tr><tr><td>All older<br>unsupported<br>PAN-OS versions</td><td>&nbsp;</td><td>Upgrade to a supported fixed version.</td></tr><tr>\n <td>Prisma Access 12.1<br></td>\n <td>12.1.2 through 12.1.10-h*</td>\n <td>Upgrade to 12.1.10-h4 or later.</td>\n </tr><tr><td>Prisma Access 11.2</td><td></td><td>Upgrade to 12.1.10-h4 or later.&nbsp;</td></tr></tbody></table><br>* See the note under Product Status for information regarding Prisma Access upgrades."
}
]
}
],
"exploits": [
{
"lang": "en",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
]
}
],
"timeline": [
{
"time": "2026-11-11T17:00:00.000Z",
"lang": "en",
"value": "Initial Publication."
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"x_affectedList": [
"PAN-OS 12.2.4-h1",
"PAN-OS 12.2.4",
"PAN-OS 12.2.3",
"PAN-OS 12.2.2",
"PAN-OS 12.1.10-h3",
"PAN-OS 12.1.10-h2",
"PAN-OS 12.1.10",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h12",
"PAN-OS 12.1.7-h11",
"PAN-OS 12.1.7-h9",
"PAN-OS 12.1.7-h8",
"PAN-OS 12.1.7-h6",
"PAN-OS 12.1.7-h5",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h14",
"PAN-OS 12.1.4-h13",
"PAN-OS 12.1.4-h12",
"PAN-OS 12.1.4-h11",
"PAN-OS 12.1.4-h10",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.16-h1",
"PAN-OS 11.2.16",
"PAN-OS 11.2.15",
"PAN-OS 11.2.13-h4",
"PAN-OS 11.2.13-h3",
"PAN-OS 11.2.13-h2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h17",
"PAN-OS 11.2.10-h16",
"PAN-OS 11.2.10-h15",
"PAN-OS 11.2.10-h14",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h23",
"PAN-OS 11.2.7-h21",
"PAN-OS 11.2.7-h20",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h24",
"PAN-OS 11.2.4-h23",
"PAN-OS 11.2.4-h22",
"PAN-OS 11.2.4-h21",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h4",
"PAN-OS 11.1.16-h3",
"PAN-OS 11.1.16-h2",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h16",
"PAN-OS 11.1.13-h15",
"PAN-OS 11.1.13-h12",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h36",
"PAN-OS 11.1.10-h35",
"PAN-OS 11.1.10-h33",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h41",
"PAN-OS 11.1.6-h40",
"PAN-OS 11.1.6-h39",
"PAN-OS 11.1.6-h38",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h39",
"PAN-OS 11.1.4-h38",
"PAN-OS 11.1.4-h37",
"PAN-OS 11.1.4-h36",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0"
],
"x_cpeGeneratedAt": "2026-11-11T19:47:33.946Z"
}
}
}
data/2026/0xxx/CVE-2026-0328.json
+1299
View File
File diff suppressed because one or more lines are too long
data/2026/0xxx/CVE-2026-0329.json
+1359
View File
File diff suppressed because one or more lines are too long
data/2026/0xxx/CVE-2026-0330.json
+1330
View File
File diff suppressed because one or more lines are too long
data/2026/0xxx/CVE-2026-0331.json
+1398
View File
File diff suppressed because one or more lines are too long
data/2026/115xxx/CVE-2026-115456.json
+28 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-10-22T15:06:48.490Z",
"datePublished": "2026-10-30T08:21:50.361Z",
"dateUpdated": "2026-11-11T14:04:29.305Z"
"dateUpdated": "2026-11-11T19:24:21.584Z"
},
"containers": {
"cna": {
@@ -122,6 +122,24 @@
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"versions": [
{
"version": "0:15.2.1-7.4.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -310,16 +328,6 @@
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gcc-toolset-15-gcc",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
@@ -710,6 +718,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98526",
"name": "RHSA-2026:98526",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:98534",
"name": "RHSA-2026:98534",
@@ -793,7 +809,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T14:04:29.305Z"
"dateUpdated": "2026-11-11T19:24:21.584Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/120xxx/CVE-2026-120286.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-04T17:15:01.545Z",
"datePublished": "2026-11-10T10:44:07.907Z",
"dateUpdated": "2026-11-11T14:01:13.773Z"
"dateUpdated": "2026-11-11T19:35:12.088Z"
},
"containers": {
"cna": {
@@ -25,8 +25,8 @@
"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'",
"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"
],
"packageName": "nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
@@ -301,7 +301,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-11T14:01:13.773Z"
"dateUpdated": "2026-11-11T19:35:12.088Z"
},
"references": [
{
data/2026/120xxx/CVE-2026-120295.json
+5 -5
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-06T09:58:06.998Z",
"datePublished": "2026-11-10T10:43:26.342Z",
"dateUpdated": "2026-11-11T14:00:26.627Z"
"dateUpdated": "2026-11-11T19:34:34.547Z"
},
"containers": {
"cna": {
@@ -24,8 +24,8 @@
"'Elixir.NervesHub.Products'",
"'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"
],
"packageName": "nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/live/devices/index.ex",
@@ -265,11 +265,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-11T14:00:26.627Z"
"dateUpdated": "2026-11-11T19:34:34.547Z"
},
"references": [
{
"name": "Users with the ‘view’ role in an organization can move devices into it and receive its firmware",
"name": "Users with the ‘view’ role in an organization can move devices into it",
"tags": [
"vendor-advisory",
"related"
data/2026/120xxx/CVE-2026-120730.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-03T03:45:01.695Z",
"datePublished": "2026-11-10T10:43:47.924Z",
"dateUpdated": "2026-11-11T13:59:36.975Z"
"dateUpdated": "2026-11-11T20:09:55.746Z"
},
"containers": {
"cna": {
@@ -29,8 +29,8 @@
"'Elixir.NervesHub.Devices.CACertificate.JITP'",
"'Elixir.NervesHub.ManagedDeployments'"
],
"packageName": "nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
@@ -353,7 +353,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-11T13:59:36.975Z"
"dateUpdated": "2026-11-11T20:09:55.746Z"
},
"references": [
{
data/2026/120xxx/CVE-2026-120997.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-05T14:30:01.700Z",
"datePublished": "2026-11-10T10:43:57.738Z",
"dateUpdated": "2026-11-11T13:59:03.563Z"
"dateUpdated": "2026-11-11T19:33:46.201Z"
},
"containers": {
"cna": {
@@ -27,8 +27,8 @@
"'Elixir.NervesHubWeb.Auth'",
"'Elixir.NervesHub.Accounts'"
],
"packageName": "nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/channels/user_socket.ex",
@@ -350,7 +350,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-11T13:59:03.563Z"
"dateUpdated": "2026-11-11T19:33:46.201Z"
},
"references": [
{
data/2026/120xxx/CVE-2026-120999.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-11-09T22:47:57.298Z",
"datePublished": "2026-11-10T10:43:38.941Z",
"dateUpdated": "2026-11-11T13:58:14.140Z"
"dateUpdated": "2026-11-11T20:10:46.282Z"
},
"containers": {
"cna": {
@@ -27,8 +27,8 @@
"'Elixir.NervesHubWeb.Live.Account'",
"'Elixir.NervesHubWeb.AccountController'"
],
"packageName": "nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub/accounts.ex",
@@ -313,7 +313,7 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-11-11T13:58:14.140Z"
"dateUpdated": "2026-11-11T20:10:46.282Z"
},
"references": [
{
data/2026/122xxx/CVE-2026-122095.json
+113
View File
@@ -0,0 +1,113 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-122095",
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"state": "PUBLISHED",
"assignerShortName": "mitre",
"dateReserved": "2026-11-04T17:28:18.529Z",
"datePublished": "2026-11-11T19:25:29.250Z",
"dateUpdated": "2026-11-11T19:28:29.250Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Management Console (sysmgnt) - menu-icon upload"
],
"product": "BSS Platform",
"vendor": "AsiaInfo",
"versions": [
{
"lessThan": "9.2.38",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre",
"dateUpdated": "2026-11-11T19:28:29.250Z"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-122095.md"
},
{
"tags": [
"issue-tracking"
],
"url": "https://orcid.org/0009-0007-0562-1331"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Update to AsiaInfo BSS Platform 9.2.38 or later (components aether-menu 2.2.5, react-app 2.3.11).</p>"
}
],
"value": "Update to AsiaInfo BSS Platform 9.2.38 or later (components aether-menu 2.2.5, react-app 2.3.11)."
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
}
}
data/2026/124xxx/CVE-2026-124742.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.478Z",
"datePublished": "2026-11-11T11:19:54.026Z",
"dateUpdated": "2026-11-11T11:19:54.026Z"
"dateUpdated": "2026-11-11T19:38:47.003Z"
},
"containers": {
"cna": {
@@ -124,13 +124,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T11:19:54.026Z"
"dateUpdated": "2026-11-11T19:38:47.003Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/124xxx/CVE-2026-124746.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-11-09T11:36:29.479Z",
"datePublished": "2026-11-11T15:03:07.440Z",
"dateUpdated": "2026-11-11T15:03:07.440Z"
"dateUpdated": "2026-11-11T19:28:24.876Z"
},
"containers": {
"cna": {
@@ -121,13 +121,13 @@
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank ducanhluu for reporting this issue."
"value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T15:03:07.440Z"
"dateUpdated": "2026-11-11T19:28:24.876Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/126xxx/CVE-2026-126784.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126784",
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"state": "PUBLISHED",
"assignerShortName": "Grayback",
"dateReserved": "2026-11-11T19:14:35.966Z",
"datePublished": "2026-11-11T19:32:12.829Z",
"dateUpdated": "2026-11-11T19:32:12.829Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback",
"dateUpdated": "2026-11-11T19:32:12.829Z"
},
"title": "Uncontrolled resource consumption via post_notice",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "XauenDevs",
"product": "Lagarto Chivato",
"versions": [
{
"status": "affected",
"version": "0.1.0",
"lessThanOrEqual": "0.4.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.4.4"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.1.0",
"versionEndIncluding": "0.4.1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Missing rate limiting, per-account submission quota and geographic validation in the <code>publicar_aviso</code> RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.&nbsp;&nbsp;"
}
]
}
],
"references": [
{
"url": "https://www.grayback.es/advisories",
"tags": [
"patch"
]
},
{
"url": "https://www.grayback.es/en/advisories",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseSeverity": "MEDIUM",
"baseScore": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
}
],
"credits": [
{
"lang": "en",
"value": "m1w34p0n",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/126xxx/CVE-2026-126815.json
+142
View File
@@ -0,0 +1,142 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126815",
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"state": "PUBLISHED",
"assignerShortName": "Grayback",
"dateReserved": "2026-11-11T20:02:32.040Z",
"datePublished": "2026-11-11T20:10:36.118Z",
"dateUpdated": "2026-11-11T20:10:36.118Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback",
"dateUpdated": "2026-11-11T20:10:36.118Z"
},
"title": "Pre-account hijacking via planted password",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-287",
"description": "CWE-287",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "XauenDevs",
"product": "Lagarto Chivato",
"versions": [
{
"status": "affected",
"version": "0.1.0",
"lessThanOrEqual": "0.4.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.4.4"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.1.0",
"versionEndIncluding": "0.4.2"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login."
}
]
}
],
"references": [
{
"url": "https://www.grayback.es/advisories",
"tags": [
"patch"
]
},
{
"url": "https://www.grayback.es/en/advisories",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseSeverity": "HIGH",
"baseScore": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "Daniel Hidalgo (hidalg0d)",
"type": "finder"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
}
}
data/2026/21xxx/CVE-2026-21620.json
+87 -39
View File
@@ -8,13 +8,12 @@
"assignerShortName": "EEF",
"dateReserved": "2026-01-01T03:46:45.934Z",
"datePublished": "2026-02-20T10:57:08.620Z",
"dateUpdated": "2026-07-24T14:16:25.195Z"
"dateUpdated": "2026-11-11T19:48:42.293Z"
},
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
@@ -22,13 +21,13 @@
"modules": [
"tftp_file"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/inets/src/tftp/tftp_file.erl",
"lib/tftp/src/tftp_file.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
@@ -50,39 +49,22 @@
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "655fb95725ba2fb811740b57e106873833824344",
"status": "unaffected"
},
{
"at": "3970738f687325138eb75f798054fa8960ac354e",
"status": "unaffected"
},
{
"at": "696fdec922661d4a3cc528fc34bc24fae8d4ad8a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"versionType": "git"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tftp_file"
],
"packageName": "inets",
"packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/tftp_file.erl"
"src/tftp/tftp_file.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
@@ -96,12 +78,15 @@
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tftp_file"
],
"packageName": "tftp",
"packageURL": "pkg:otp/tftp?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/tftp?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/tftp_file.erl"
@@ -130,6 +115,47 @@
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tftp_file"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/inets/src/tftp/tftp_file.erl",
"lib/tftp/src/tftp_file.erl"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "655fb95725ba2fb811740b57e106873833824344",
"status": "unaffected"
},
{
"at": "3970738f687325138eb75f798054fa8960ac354e",
"status": "unaffected"
},
{
"at": "696fdec922661d4a3cc528fc34bc24fae8d4ad8a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"versionType": "git"
}
]
}
],
"configurations": [
@@ -139,7 +165,12 @@
{
"base64": false,
"type": "text/html",
"value": "A TFTP server must be started and the TFTP port must be reachable by the attacker, using the <tt>tftp</tt> application (or the legacy <tt>inets</tt> TFTP service) with the <tt>tftp_file</tt> callback module configured with the <tt>{root_dir, Dir}</tt> option."
"value": "<p>A TFTP server must be started and the TFTP port must be reachable by the attacker, using the <code>tftp</code> application (or the legacy <code>inets</code> TFTP service) with the <code>tftp_file</code> callback module configured with the <code>{root_dir, Dir}</code> option.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "A TFTP server must be started and the TFTP port must be reachable by the attacker, using the `tftp` application (or the legacy `inets` TFTP service) with the `tftp_file` callback module configured with the `{root_dir, Dir}` option."
}
],
"value": "A TFTP server must be started and the TFTP port must be reachable by the attacker, using the tftp application (or the legacy inets TFTP service) with the tftp_file callback module configured with the {root_dir, Dir} option."
@@ -153,6 +184,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.17",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -192,6 +224,7 @@
"value": "Raimo Niskanen"
}
],
"datePublic": "2026-02-20T10:57:08.000Z",
"descriptions": [
{
"lang": "en",
@@ -199,10 +232,15 @@
{
"base64": false,
"type": "text/html",
"value": "Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.<p> This vulnerability is associated with program files <tt>lib/tftp/src/tftp_file.erl</tt>, <tt>src/tftp_file.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.3.2, OTP&nbsp;27.3.4.8 and OTP&nbsp;26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.</p>"
"value": "<p>Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.</p>\n<p>This vulnerability is associated with program files <code>lib/tftp/src/tftp_file.erl</code>, <code>src/tftp_file.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.17, OTP&nbsp;27.3.4.8, and OTP&nbsp;28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.\n\nThis vulnerability is associated with program files `lib/tftp/src/tftp_file.erl`, `src/tftp_file.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4."
}
],
"value": "Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0."
"value": "Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal.\n\nThis vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.17, OTP 27.3.4.8, and OTP 28.3.2, corresponding to inets from 5.10 before 7.0, and tftp from 1.0 before 1.1.1.1, 1.2.2.1, and 1.2.4."
}
],
"impacts": [
@@ -227,7 +265,6 @@
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -266,10 +303,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:16:25.195Z"
"dateUpdated": "2026-11-11T19:48:42.293Z"
},
"references": [
{
"name": "TFTP Path Traversal",
"tags": [
"vendor-advisory",
"related"
@@ -277,18 +315,21 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp"
},
{
"name": "EEF CNA record for CVE-2026-21620",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-21620.html"
},
{
"name": "OSV record EEF-CVE-2026-21620",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-21620"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
@@ -301,31 +342,38 @@
"url": "https://github.com/erlang/otp/pull/10706"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 655fb95 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a"
"url": "https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344"
},
{
"name": "Fix commit 3970738 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e"
},
{
"name": "Fix commit 696fdec in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/655fb95725ba2fb811740b57e106873833824344"
"url": "https://github.com/erlang/otp/commit/696fdec922661d4a3cc528fc34bc24fae8d4ad8a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TFTP Path Traversal",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
"title": "TFTP Path Traversal"
},
"adp": [
{
data/2026/23xxx/CVE-2026-23941.json
+99 -39
View File
@@ -8,11 +8,54 @@
"assignerShortName": "EEF",
"dateReserved": "2026-01-19T14:23:14.343Z",
"datePublished": "2026-03-13T09:11:58.175Z",
"dateUpdated": "2026-07-24T14:15:30.978Z"
"dateUpdated": "2026-11-11T19:45:01.134Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"modules": [
"httpd_request"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/inets/src/http_server/httpd_request.erl"
],
"programRoutines": [
{
"name": "httpd_request:parse_headers/7"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.18",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "28.4.1",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +65,7 @@
"httpd_request"
],
"packageName": "inets",
"packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/http_server/httpd_request.erl"
@@ -38,7 +81,7 @@
{
"changes": [
{
"at": "9.6.1",
"at": "9.1.0.5",
"status": "unaffected"
},
{
@@ -46,7 +89,7 @@
"status": "unaffected"
},
{
"at": "9.1.0.5",
"at": "9.6.1",
"status": "unaffected"
}
],
@@ -83,27 +126,7 @@
{
"changes": [
{
"at": "28.4.1",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "26.2.5.18",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "a4b46336fd25aa100ac602eb9a627aaead7eda18",
"at": "e775a332f623851385ab6ddb866d9b150612ddf6",
"status": "unaffected"
},
{
@@ -111,7 +134,7 @@
"status": "unaffected"
},
{
"at": "e775a332f623851385ab6ddb866d9b150612ddf6",
"at": "a4b46336fd25aa100ac602eb9a627aaead7eda18",
"status": "unaffected"
}
],
@@ -119,6 +142,24 @@
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "e775a332f623851385ab6ddb866d9b150612ddf6",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "a761d391d8d08316cbd7d4a86733ba932b73c45b",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "a4b46336fd25aa100ac602eb9a627aaead7eda18",
"versionType": "git"
}
]
}
@@ -130,6 +171,11 @@
{
"base64": false,
"type": "text/html",
"value": "<p>The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default)."
}
],
@@ -178,6 +224,7 @@
"value": "Konrad Pietrzak"
}
],
"datePublic": "2026-03-13T09:11:58.000Z",
"descriptions": [
{
"lang": "en",
@@ -185,10 +232,15 @@
{
"base64": false,
"type": "text/html",
"value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.<p>This vulnerability is associated with program files <tt>lib/inets/src/http_server/httpd_request.erl</tt> and program routines <tt>httpd_request:parse_headers/7</tt>.</p><p>The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.1, OTP&nbsp;27.3.4.9 and OTP&nbsp;26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.</p>"
"value": "<p>Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.</p>\n<p>This vulnerability is associated with program files <code>lib/inets/src/http_server/httpd_request.erl</code> and program routines <code>httpd_request:parse_headers/7</code>.</p>\n<p>The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/httpd_request.erl` and program routines `httpd_request:parse_headers/7`.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5."
"value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"impacts": [
@@ -213,7 +265,6 @@
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
@@ -242,7 +293,7 @@
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests",
"lang": "en",
"type": "CWE"
}
@@ -252,10 +303,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:15:30.978Z"
"dateUpdated": "2026-11-11T19:45:01.134Z"
},
"references": [
{
"name": "Request smuggling via first-wins Content-Length parsing in inets httpd",
"tags": [
"vendor-advisory",
"related"
@@ -263,40 +315,46 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7"
},
{
"name": "EEF CNA record for CVE-2026-23941",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-23941.html"
},
{
"name": "OSV record EEF-CVE-2026-23941",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23941"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Fix commit e775a33 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18"
"url": "https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6"
},
{
"name": "Fix commit a761d39 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b"
},
{
"name": "Fix commit a4b4633 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6"
"url": "https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18"
}
],
"source": {
@@ -310,15 +368,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Configure frontend proxy to reject requests with duplicate Content-Length headers.</li><li>Disable HTTP keep-alive on httpd by adding <tt>{keep_alive, false}</tt> to httpd configuration. Note: This impacts performance for clients making multiple requests.</li><li>Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.</li></ul>"
"value": "<ul>\n<li>Configure frontend proxy to reject requests with duplicate Content-Length headers.</li>\n<li>Disable HTTP keep-alive on httpd by adding <code>{keep_alive, false}</code> to httpd configuration. Note: This impacts performance for clients making multiple requests.</li>\n<li>Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers."
}
],
"value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers."
"value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding {keep_alive, false} to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/23xxx/CVE-2026-23942.json
+99 -39
View File
@@ -8,11 +8,54 @@
"assignerShortName": "EEF",
"dateReserved": "2026-01-19T14:23:14.343Z",
"datePublished": "2026-03-13T09:11:56.424Z",
"dateUpdated": "2026-07-24T14:16:12.645Z"
"dateUpdated": "2026-11-11T19:42:24.004Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"modules": [
"ssh_sftpd"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"programRoutines": [
{
"name": "ssh_sftpd:is_within_root/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.18",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "28.4.1",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +65,7 @@
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_sftpd.erl"
@@ -38,7 +81,7 @@
{
"changes": [
{
"at": "5.5.1",
"at": "5.1.4.14",
"status": "unaffected"
},
{
@@ -46,7 +89,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.14",
"at": "5.5.1",
"status": "unaffected"
}
],
@@ -83,27 +126,7 @@
{
"changes": [
{
"at": "28.4.1",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "26.2.5.18",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "27688a824f753d4c16371dc70e88753fb410590b",
"at": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759",
"status": "unaffected"
},
{
@@ -111,7 +134,7 @@
"status": "unaffected"
},
{
"at": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759",
"at": "27688a824f753d4c16371dc70e88753fb410590b",
"status": "unaffected"
}
],
@@ -119,6 +142,24 @@
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "9e0ac85d3485e7898e0da88a14be0ee2310a3b28",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "27688a824f753d4c16371dc70e88753fb410590b",
"versionType": "git"
}
]
}
@@ -130,7 +171,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when <tt>ssh_sftpd</tt> is included in the <tt>subsystems</tt> option with a <tt>root</tt> parameter and there exist sibling directories sharing the same name prefix as the root."
"value": "<p>The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when <code>ssh_sftpd</code> is included in the <code>subsystems</code> option with a <code>root</code> parameter and there exist sibling directories sharing the same name prefix as the root.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when `ssh_sftpd` is included in the `subsystems` option with a `root` parameter and there exist sibling directories sharing the same name prefix as the root."
}
],
"value": "The SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when ssh_sftpd is included in the subsystems option with a root parameter and there exist sibling directories sharing the same name prefix as the root."
@@ -183,6 +229,7 @@
"value": "Michał Wąsowski"
}
],
"datePublic": "2026-03-13T09:11:56.000Z",
"descriptions": [
{
"lang": "en",
@@ -190,10 +237,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.<p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt> and program routines <tt>ssh_sftpd:is_within_root/2</tt>.</p><p>The SFTP server uses string prefix matching via <tt>lists:prefix/2</tt> rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to <tt>/home/user1</tt>, paths like <tt>/home/user10</tt> or <tt>/home/user1_backup</tt> would incorrectly be considered within the root.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.1, OTP&nbsp;27.3.4.9 and OTP&nbsp;26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.</p>"
"value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code> and program routines <code>ssh_sftpd:is_within_root/2</code>.</p>\n<p>The SFTP server uses string prefix matching via <code>lists:prefix/2</code> rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to <code>/home/user1</code>, paths like <code>/home/user10</code> or <code>/home/user1_backup</code> would incorrectly be considered within the root.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP&nbsp;17.0, corresponding to ssh before 3.0.1, is affected is unknown.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl` and program routines `ssh_sftpd:is_within_root/2`.\n\nThe SFTP server uses string prefix matching via `lists:prefix/2` rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to `/home/user1`, paths like `/home/user10` or `/home/user1_backup` would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14."
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown."
}
],
"impacts": [
@@ -218,7 +270,6 @@
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -247,7 +298,7 @@
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
@@ -257,10 +308,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:16:12.645Z"
"dateUpdated": "2026-11-11T19:42:24.004Z"
},
"references": [
{
"name": "SFTP root escape via component-agnostic prefix check in `ssh_sftpd`",
"tags": [
"vendor-advisory",
"related"
@@ -268,40 +320,46 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h"
},
{
"name": "EEF CNA record for CVE-2026-23942",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-23942.html"
},
{
"name": "OSV record EEF-CVE-2026-23942",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23942"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Fix commit 5ed603a in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b"
"url": "https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759"
},
{
"name": "Fix commit 9e0ac85 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28"
},
{
"name": "Fix commit 27688a8 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759"
"url": "https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b"
}
],
"source": {
@@ -315,15 +373,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.</li><li>Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.</li><li>Ensure that the SFTP server port is not reachable from untrusted machines.</li><li>Use directory naming conventions that avoid common prefixes (e.g., <tt>/home/users/alice/</tt> instead of <tt>/home/user1/</tt>).</li></ul>"
"value": "<ul>\n<li>Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.</li>\n<li>Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.</li>\n<li>Ensure that the SFTP server port is not reachable from untrusted machines.</li>\n<li>Use directory naming conventions that avoid common prefixes (e.g., <code>/home/users/alice/</code> instead of <code>/home/user1/</code>).</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., `/home/users/alice/` instead of `/home/user1/`)."
}
],
"value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Use directory naming conventions that avoid common prefixes (e.g., /home/users/alice/ instead of /home/user1/)."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/23xxx/CVE-2026-23943.json
+94 -41
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-01-19T14:23:14.343Z",
"datePublished": "2026-03-13T09:11:57.794Z",
"dateUpdated": "2026-07-24T14:15:38.635Z"
"dateUpdated": "2026-11-11T19:44:14.524Z"
},
"containers": {
"cna": {
@@ -17,12 +17,58 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_transport"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_transport.erl"
],
"programRoutines": [
{
"name": "ssh_transport:decompress/2"
},
{
"name": "ssh_transport:handle_packet_part/4"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.18",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "28.4.1",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssh_transport"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_transport.erl"
@@ -41,7 +87,7 @@
{
"changes": [
{
"at": "5.5.1",
"at": "5.1.4.14",
"status": "unaffected"
},
{
@@ -49,7 +95,7 @@
"status": "unaffected"
},
{
"at": "5.1.4.14",
"at": "5.5.1",
"status": "unaffected"
}
],
@@ -65,7 +111,7 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssh_transport"
],
@@ -89,27 +135,7 @@
{
"changes": [
{
"at": "28.4.1",
"status": "unaffected"
},
{
"at": "27.3.4.9",
"status": "unaffected"
},
{
"at": "26.2.5.18",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "43a87b949bdff12d629a8c34146711d9da93b1b1",
"at": "0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4",
"status": "unaffected"
},
{
@@ -117,7 +143,7 @@
"status": "unaffected"
},
{
"at": "0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4",
"at": "43a87b949bdff12d629a8c34146711d9da93b1b1",
"status": "unaffected"
}
],
@@ -136,7 +162,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SSH server or client must advertise <tt>zlib</tt> or <tt>zlib@openssh.com</tt> compression. Both are enabled by default. With <tt>zlib</tt>, the attack is pre-authentication; with <tt>zlib@openssh.com</tt>, authentication is required first."
"value": "<p>The SSH server or client must advertise <code>zlib</code> or <code>zlib@openssh.com</code> compression. Both are enabled by default. With <code>zlib</code>, the attack is pre-authentication; with <code>zlib@openssh.com</code>, authentication is required first.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SSH server or client must advertise `zlib` or `zlib@openssh.com` compression. Both are enabled by default. With `zlib`, the attack is pre-authentication; with `zlib@openssh.com`, authentication is required first."
}
],
"value": "The SSH server or client must advertise zlib or zlib@openssh.com compression. Both are enabled by default. With zlib, the attack is pre-authentication; with zlib@openssh.com, authentication is required first."
@@ -150,6 +181,7 @@
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.5.18",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
@@ -189,6 +221,7 @@
"value": "Jakub Witczak"
}
],
"datePublic": "2026-03-13T09:11:57.000Z",
"descriptions": [
{
"lang": "en",
@@ -196,10 +229,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.<p>The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.</p><p>Two compression algorithms are affected:</p><ul><li><b>zlib:</b> Activates immediately after key exchange, enabling unauthenticated attacks</li><li><b>zlib@openssh.com:</b> Activates post-authentication, enabling authenticated attacks</li></ul><p>Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_transport.erl</tt> and program routines <tt>ssh_transport:decompress/2</tt>, <tt>ssh_transport:handle_packet_part/4</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.1, OTP&nbsp;27.3.4.9 and OTP&nbsp;26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.</p>"
"value": "<p>Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.</p>\n<p>The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.</p>\n<p>Two compression algorithms are affected:</p>\n<ul>\n<li><strong><code>zlib</code>:</strong> Activates immediately after key exchange, enabling unauthenticated attacks</li>\n<li><strong><code>zlib@openssh.com</code>:</strong> Activates post-authentication, enabling authenticated attacks</li>\n</ul>\n<p>Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_transport.erl</code> and program routines <code>ssh_transport:decompress/2</code>, <code>ssh_transport:handle_packet_part/4</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* **`zlib`:** Activates immediately after key exchange, enabling unauthenticated attacks\n* **`zlib@openssh.com`:** Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_transport.erl` and program routines `ssh_transport:decompress/2`, `ssh_transport:handle_packet_part/4`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1."
}
],
"value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14."
"value": "Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks\n\nEach SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to ssh from 3.0.1 before 5.1.4.14, 5.2.11.6, and 5.5.1."
}
],
"impacts": [
@@ -233,7 +271,6 @@
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -272,10 +309,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:15:38.635Z"
"dateUpdated": "2026-11-11T19:44:14.524Z"
},
"references": [
{
"name": "Pre-auth SSH DoS via unbounded zlib inflate",
"tags": [
"vendor-advisory",
"related"
@@ -283,40 +321,53 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-c836-qprm-jw9r"
},
{
"name": "EEF CNA record for CVE-2026-23943",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-23943.html"
},
{
"name": "OSV record EEF-CVE-2026-23943",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23943"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 0c1c04b in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1"
"url": "https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4"
},
{
"name": "Fix commit 93073c3 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3"
},
{
"name": "Fix commit 43a87b9 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/0c1c04b191f6ab940e8fcfabce39eb5a8a6440a4"
"url": "https://github.com/erlang/otp/commit/43a87b949bdff12d629a8c34146711d9da93b1b1"
}
],
"source": {
@@ -330,15 +381,17 @@
{
"base64": false,
"type": "text/html",
"value": "<p><b>Best workaround - Disable all compression:</b></p><pre>{preferred_algorithms, [{compression, ['none']}]}</pre><p><b>Alternative mitigations (less secure):</b></p><ul><li>Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):<pre>{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}</pre></li><li>Limit concurrent sessions (reduces attack surface but does not prevent exploitation):<pre>{max_sessions, N} % Cap total concurrent sessions (default is infinity)</pre></li></ul>"
"value": "<p><strong>Best workaround - Disable all compression:</strong></p>\n<pre><code class=\"language-erlang\">{preferred_algorithms, [{compression, ['none']}]}\n</code></pre>\n<p><strong>Alternative mitigations (less secure):</strong></p>\n<ul>\n<li>\n<p>Disable only pre-auth zlib compression (authenticated users can still exploit via <code>zlib@openssh.com</code>):</p>\n<pre><code class=\"language-erlang\">{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n</code></pre>\n</li>\n<li>\n<p>Limit concurrent sessions (reduces attack surface but does not prevent exploitation):</p>\n<pre><code class=\"language-erlang\">{max_sessions, N} % Cap total concurrent sessions (default is infinity)\n</code></pre>\n</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "**Best workaround - Disable all compression:**\n\n```erlang\n{preferred_algorithms, [{compression, ['none']}]}\n```\n\n**Alternative mitigations (less secure):**\n\n* Disable only pre-auth zlib compression (authenticated users can still exploit via `zlib@openssh.com`):\n\n ```erlang\n {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n ```\n\n* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):\n\n ```erlang\n {max_sessions, N} % Cap total concurrent sessions (default is infinity)\n ```"
}
],
"value": "Best workaround - Disable all compression:\n\n{preferred_algorithms, [{compression, ['none']}]}\n\nAlternative mitigations (less secure):\n\n* Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):\n {modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):\n {max_sessions, N} % Cap total concurrent sessions (default is infinity)"
"value": "Best workaround - Disable all compression:\n\n{preferred_algorithms, [{compression, ['none']}]}\n\nAlternative mitigations (less secure):\n\n* Disable only pre-auth zlib compression (authenticated users can still exploit via zlib@openssh.com):\n{modify_algorithms, [{rm, [{compression, ['zlib']}]}]}\n* Limit concurrent sessions (reduces attack surface but does not prevent exploitation):\n{max_sessions, N} % Cap total concurrent sessions (default is infinity)"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/28xxx/CVE-2026-28806.json
+40 -14
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-03-03T14:40:00.589Z",
"datePublished": "2026-03-10T21:30:58.581Z",
"dateUpdated": "2026-05-27T15:41:33.000Z"
"dateUpdated": "2026-11-11T19:36:02.122Z"
},
"containers": {
"cna": {
@@ -19,7 +19,7 @@
],
"defaultStatus": "unaffected",
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
@@ -39,7 +39,7 @@
],
"defaultStatus": "unaffected",
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
@@ -47,7 +47,7 @@
"lessThan": "2.4.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
"versionType": "other"
}
]
},
@@ -60,14 +60,20 @@
"packageName": "nerves-hub/nerves_hub_web",
"packageURL": "pkg:github/nerves-hub/nerves_hub_web",
"product": "nerves_hub_web",
"repo": "https://github.com/nerves-hub/nerves_hub_web.git",
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "1f69c9d595684a4650c3ac702f3dc7c5bcd7526c",
"lessThan": "*",
"status": "affected",
"version": "adaeefdb7a835525482588f43332ef988cc448c7",
"versionType": "git"
},
{
"lessThan": "1f69c9d595684a4650c3ac702f3dc7c5bcd7526c",
"status": "affected",
"version": "79743ef08f7f801617b653fd09f37c01ed9b4be0",
"versionType": "git"
}
]
}
@@ -108,6 +114,7 @@
"value": "Lars Wikman / NervesHub team & NervesCloud"
}
],
"datePublic": "2026-03-10T21:30:58.000Z",
"descriptions": [
{
"lang": "en",
@@ -115,10 +122,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.<p>Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.</p><p>An attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.</p><p>In environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.</p><p>This issue affects nerves_hub_web: from 1.0.0 before 2.4.0.</p>"
"value": "<p>Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.</p>\n<p>Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.</p>\n<p>An attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.</p>\n<p>In environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.</p>\n<p>This issue affects nerves_hub: from 1.0.0 before 2.4.0.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.\n\nMissing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.\n\nAn attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.\n\nIn environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.4.0."
}
],
"value": "Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.\n\nMissing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.\n\nAn attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.\n\nIn environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.\n\nThis issue affects nerves_hub_web: from 1.0.0 before 2.4.0."
"value": "Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.\n\nMissing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.\n\nAn attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.\n\nIn environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.4.0."
}
],
"impacts": [
@@ -143,7 +155,6 @@
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
@@ -192,10 +203,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-05-27T15:41:33.000Z"
"dateUpdated": "2026-11-11T19:36:02.122Z"
},
"references": [
{
"name": "Improper authorization in device bulk actions and API allows cross-organization device control",
"tags": [
"vendor-advisory",
"related"
@@ -203,18 +215,35 @@
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-f8fr-mccc-xvcx"
},
{
"name": "EEF CNA record for CVE-2026-28806",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-28806.html"
},
{
"name": "OSV record EEF-CVE-2026-28806",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-28806"
},
{
"name": "Introducing commit adaeefd in nerves-hub/nerves_hub_web",
"tags": [
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7"
},
{
"name": "Introducing commit 79743ef in nerves-hub/nerves_hub_web",
"tags": [
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0"
},
{
"name": "Fix commit 1f69c9d in nerves-hub/nerves_hub_web",
"tags": [
"patch"
],
@@ -224,10 +253,7 @@
"source": {
"discovery": "INTERNAL"
},
"title": "Improper authorization in device bulk actions and device update API allows cross-organization device control",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
"title": "Improper authorization in device bulk actions and device update API allows cross-organization device control"
},
"adp": [
{
data/2026/28xxx/CVE-2026-28810.json
+89 -57
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-03-03T14:40:00.590Z",
"datePublished": "2026-04-07T07:50:11.072Z",
"dateUpdated": "2026-07-24T14:16:14.097Z"
"dateUpdated": "2026-11-11T19:28:21.075Z"
},
"containers": {
"cna": {
@@ -17,13 +17,53 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"inet_res",
"inet_db"
"inet_db",
"inet_res"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/kernel/src/inet_db.erl",
"lib/kernel/src/inet_res.erl"
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.19",
"status": "unaffected"
},
{
"at": "27.3.4.10",
"status": "unaffected"
},
{
"at": "28.4.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"inet_db",
"inet_res"
],
"packageName": "kernel",
"packageURL": "pkg:otp/kernel?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/kernel?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/inet_db.erl",
@@ -35,7 +75,7 @@
{
"changes": [
{
"at": "10.6.2",
"at": "9.2.4.11",
"status": "unaffected"
},
{
@@ -43,7 +83,7 @@
"status": "unaffected"
},
{
"at": "9.2.4.11",
"at": "10.6.2",
"status": "unaffected"
}
],
@@ -59,10 +99,10 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"inet_res",
"inet_db"
"inet_db",
"inet_res"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
@@ -75,41 +115,7 @@
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "28.4.2",
"status": "unaffected"
},
{
"at": "27.3.4.10",
"status": "unaffected"
},
{
"at": "26.2.5.19",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "36f23c9d2cc54afe83671dd7343596d7972839a5",
"status": "unaffected"
},
{
"at": "dd15e8eb03548c5e55e9915f0e91389ec6bad9fd",
"status": "unaffected"
},
{
"at": "b057a9d995017b1be50d6dc02edd52382f3231b8",
"status": "unaffected"
}
],
"lessThan": "*",
"lessThan": "b057a9d995017b1be50d6dc02edd52382f3231b8",
"status": "affected",
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"versionType": "git"
@@ -124,7 +130,12 @@
{
"base64": false,
"type": "text/html",
"value": "The application must use <tt>inet_res</tt> for DNS resolution, either by configuring the lookup method to include <tt>dns</tt> in the kernel inet configuration, or by calling <tt>inet_res</tt> functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected."
"value": "<p>The application must use <code>inet_res</code> for DNS resolution, either by configuring the lookup method to include <code>dns</code> in the kernel inet configuration, or by calling <code>inet_res</code> functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application must use `inet_res` for DNS resolution, either by configuring the lookup method to include `dns` in the kernel inet configuration, or by calling `inet_res` functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected."
}
],
"value": "The application must use inet_res for DNS resolution, either by configuring the lookup method to include dns in the kernel inet configuration, or by calling inet_res functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected."
@@ -173,6 +184,7 @@
"value": "Raimo Niskanen"
}
],
"datePublic": "2026-04-07T07:50:11.000Z",
"descriptions": [
{
"lang": "en",
@@ -180,10 +192,15 @@
{
"base64": false,
"type": "text/html",
"value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.<p>The built-in DNS resolver (<tt>inet_res</tt>) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.</p><p><tt>inet_res</tt> is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.</p><p>This vulnerability is associated with program files <tt>lib/kernel/src/inet_db.erl</tt> and <tt>lib/kernel/src/inet_res.erl</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.2, OTP&nbsp;27.3.4.10 and OTP&nbsp;26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.</p>"
"value": "<p>Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.</p>\n<p>The built-in DNS resolver (<code>inet_res</code>) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.</p>\n<p><code>inet_res</code> is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.</p>\n<p>This vulnerability is associated with program files <code>lib/kernel/src/inet_db.erl</code> and <code>lib/kernel/src/inet_res.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.19, OTP&nbsp;27.3.4.10, and OTP&nbsp;28.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (`inet_res`) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\n`inet_res` is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files `lib/kernel/src/inet_db.erl` and `lib/kernel/src/inet_res.erl`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2."
}
],
"value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11."
"value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2."
}
],
"impacts": [
@@ -208,7 +225,6 @@
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -247,10 +263,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:16:14.097Z"
"dateUpdated": "2026-11-11T19:28:21.075Z"
},
"references": [
{
"name": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver",
"tags": [
"vendor-advisory",
"related"
@@ -258,40 +275,53 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8"
},
{
"name": "EEF CNA record for CVE-2026-28810",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-28810.html"
},
{
"name": "OSV record EEF-CVE-2026-28810",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-28810"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit b057a9d in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5"
"url": "https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8"
},
{
"name": "Fix commit dd15e8e in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd"
},
{
"name": "Fix commit 36f23c9 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8"
"url": "https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5"
}
],
"source": {
@@ -305,15 +335,17 @@
{
"base64": false,
"type": "text/html",
"value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the <tt>inet_res</tt> resolver to only talk to trusted recursive name servers within that network."
"value": "<p>Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the <code>inet_res</code> resolver to only talk to trusted recursive name servers within that network.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the `inet_res` resolver to only talk to trusted recursive name servers within that network."
}
],
"value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the inet_res resolver to only talk to trusted recursive name servers within that network."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/32xxx/CVE-2026-32144.json
+93 -41
View File
@@ -8,7 +8,7 @@
"assignerShortName": "EEF",
"dateReserved": "2026-03-10T22:37:29.212Z",
"datePublished": "2026-04-07T12:28:00.767Z",
"dateUpdated": "2026-07-24T14:14:52.819Z"
"dateUpdated": "2026-11-11T19:24:15.856Z"
},
"containers": {
"cna": {
@@ -17,12 +17,53 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"pubkey_ocsp",
"ssl_stapling"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/public_key/src/pubkey_ocsp.erl",
"lib/ssl/src/ssl_stapling.erl"
],
"programRoutines": [
{
"name": "pubkey_ocsp:is_authorized_responder/3"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.10",
"status": "unaffected"
},
{
"at": "28.4.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "27.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"pubkey_ocsp"
],
"packageName": "public_key",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/pubkey_ocsp.erl"
@@ -38,11 +79,11 @@
{
"changes": [
{
"at": "1.20.3",
"at": "1.17.1.2",
"status": "unaffected"
},
{
"at": "1.17.1.2",
"at": "1.20.3",
"status": "unaffected"
}
],
@@ -57,12 +98,12 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"ssl_stapling"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssl_stapling.erl"
@@ -73,11 +114,11 @@
{
"changes": [
{
"at": "11.5.4",
"at": "11.2.12.7",
"status": "unaffected"
},
{
"at": "11.2.12.7",
"at": "11.5.4",
"status": "unaffected"
}
],
@@ -93,15 +134,17 @@
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"defaultStatus": "unaffected",
"modules": [
"pubkey_ocsp"
"pubkey_ocsp",
"ssl_stapling"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/public_key/src/pubkey_ocsp.erl"
"lib/public_key/src/pubkey_ocsp.erl",
"lib/ssl/src/ssl_stapling.erl"
],
"programRoutines": [
{
@@ -114,28 +157,12 @@
{
"changes": [
{
"at": "28.4.2",
"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0",
"status": "unaffected"
},
{
"at": "27.3.4.10",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "27.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891",
"status": "unaffected"
},
{
"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0",
"status": "unaffected"
}
],
"lessThan": "*",
@@ -153,7 +180,12 @@
{
"base64": false,
"type": "text/html",
"value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., <tt>{stapling, staple}</tt>), or the application must call <tt>public_key:pkix_ocsp_validate/5</tt> directly. OCSP stapling is disabled by default (<tt>{stapling, no_staple}</tt>)."
"value": "<p>SSL/TLS must be configured with OCSP stapling enabled (e.g., <code>{stapling, staple}</code>), or the application must call <code>public_key:pkix_ocsp_validate/5</code> directly. OCSP stapling is disabled by default (<code>{stapling, no_staple}</code>).</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., `{stapling, staple}`), or the application must call `public_key:pkix_ocsp_validate/5` directly. OCSP stapling is disabled by default (`{stapling, no_staple}`)."
}
],
"value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., {stapling, staple}), or the application must call public_key:pkix_ocsp_validate/5 directly. OCSP stapling is disabled by default ({stapling, no_staple})."
@@ -201,6 +233,7 @@
"value": "Ingela Anderton Andin"
}
],
"datePublic": "2026-04-07T12:28:00.000Z",
"descriptions": [
{
"lang": "en",
@@ -208,10 +241,15 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.<p>The OCSP response validation in <tt>public_key:pkix_ocsp_validate/5</tt> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p><p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <tt>public_key:pkix_ocsp_validate/5</tt> API directly are also affected, with impact depending on usage context.</p><p>This vulnerability is associated with program files <tt>lib/public_key/src/pubkey_ocsp.erl</tt> and program routines <tt>pubkey_ocsp:is_authorized_responder/3</tt>.</p><p>This issue affects OTP from OTP 27.0 before OTP&nbsp;28.4.2 and OTP&nbsp;27.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7.</p>"
"value": "<p>Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.</p>\n<p>The OCSP response validation in <code>public_key:pkix_ocsp_validate/5</code> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p>\n<p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <code>public_key:pkix_ocsp_validate/5</code> API directly are also affected, with impact depending on usage context.</p>\n<p>This vulnerability is associated with program files <code>lib/public_key/src/pubkey_ocsp.erl</code> and program routines <code>pubkey_ocsp:is_authorized_responder/3</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;27.0 before OTP&nbsp;27.3.4.10 and OTP&nbsp;28.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in `public_key:pkix_ocsp_validate/5` does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the `public_key:pkix_ocsp_validate/5` API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files `lib/public_key/src/pubkey_ocsp.erl` and program routines `pubkey_ocsp:is_authorized_responder/3`.\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.10 and OTP 28.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4."
}
],
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 before OTP 28.4.2 and OTP 27.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7."
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.10 and OTP 28.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4."
}
],
"impacts": [
@@ -236,7 +274,6 @@
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -275,10 +312,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:52.819Z"
"dateUpdated": "2026-11-11T19:24:15.856Z"
},
"references": [
{
"name": "OCSP designated-responder authorization bypass — missing signature verification (RFC 6960 §4.2.2.2)",
"tags": [
"vendor-advisory",
"related"
@@ -286,34 +324,46 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm"
},
{
"name": "EEF CNA record for CVE-2026-32144",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-32144.html"
},
{
"name": "OSV record EEF-CVE-2026-32144",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 601a012 in erlang/otp",
"tags": [
"patch"
"related"
],
"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"
"url": "https://github.com/erlang/otp/commit/601a012837ea0a5c8095bf24223132824177124d"
},
{
"name": "Fix commit 49033a6 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"
},
{
"name": "Fix commit ac7ff52 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"
}
],
"source": {
@@ -327,15 +377,17 @@
{
"base64": false,
"type": "text/html",
"value": "<p><b>For SSL users:</b></p><ul><li>Do not enable OCSP validation setting (current default is <tt>{stapling, no_staple}</tt>)</li><li>Use CRL-based revocation checking by setting the <tt>{crl_check, true}</tt> SSL option instead</li></ul><p><b>For applications using <tt>public_key:pkix_ocsp_validate/5</tt> directly:</b></p><ul><li>Pass <tt>{is_trusted_responder_fun, Fun}</tt> option with a function that validates trusted responder certificates</li><li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li></ul>"
"value": "<p><strong>For SSL users:</strong></p>\n<ul>\n<li>Do not enable OCSP validation setting (current default is <code>{stapling, no_staple}</code>)</li>\n<li>Use CRL-based revocation checking by setting the <code>{crl_check, true}</code> SSL option instead</li>\n</ul>\n<p><strong>For applications using <code>public_key:pkix_ocsp_validate/5</code> directly:</strong></p>\n<ul>\n<li>Pass <code>{is_trusted_responder_fun, Fun}</code> option with a function that validates trusted responder certificates</li>\n<li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "**For SSL users:**\n\n* Do not enable OCSP validation setting (current default is `{stapling, no_staple}`)\n* Use CRL-based revocation checking by setting the `{crl_check, true}` SSL option instead\n\n**For applications using `public_key:pkix_ocsp_validate/5` directly:**\n\n* Pass `{is_trusted_responder_fun, Fun}` option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)"
}
],
"value": "For SSL users:\n\n* Do not enable OCSP validation setting (current default is {stapling, no_staple})\n* Use CRL-based revocation checking by setting the {crl_check, true} SSL option instead\n\nFor applications using public_key:pkix_ocsp_validate/5 directly:\n\n* Pass {is_trusted_responder_fun, Fun} option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/32xxx/CVE-2026-32147.json
+104 -43
View File
@@ -8,11 +8,57 @@
"assignerShortName": "EEF",
"dateReserved": "2026-03-10T22:37:29.213Z",
"datePublished": "2026-04-21T12:01:20.350Z",
"dateUpdated": "2026-07-24T14:14:17.633Z"
"dateUpdated": "2026-11-11T19:21:07.336Z"
},
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"modules": [
"ssh_sftpd"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssh/src/ssh_sftpd.erl"
],
"programRoutines": [
{
"name": "ssh_sftpd:do_open/4"
},
{
"name": "ssh_sftpd:handle_op/4"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "26.2.5.20",
"status": "unaffected"
},
{
"at": "27.3.4.11",
"status": "unaffected"
},
{
"at": "28.4.3",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
@@ -22,7 +68,7 @@
"ssh_sftpd"
],
"packageName": "ssh",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssh_sftpd.erl"
@@ -41,7 +87,7 @@
{
"changes": [
{
"at": "5.5.3",
"at": "5.1.4.15",
"status": "unaffected"
},
{
@@ -49,13 +95,13 @@
"status": "unaffected"
},
{
"at": "5.1.4.15",
"at": "5.5.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "3.01",
"version": "3.0.1",
"versionType": "otp"
}
]
@@ -87,36 +133,16 @@
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "28.4.3",
"status": "unaffected"
},
{
"at": "27.3.4.11",
"status": "unaffected"
},
{
"at": "26.2.5.20",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "28c5d5a6c5f873dc701b597276271763e7d1c004",
"status": "unaffected"
}
],
"lessThan": "*",
"lessThan": "28c5d5a6c5f873dc701b597276271763e7d1c004",
"status": "affected",
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"versionType": "git"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "28c5d5a6c5f873dc701b597276271763e7d1c004",
"versionType": "git"
}
]
}
@@ -128,7 +154,12 @@
{
"base64": false,
"type": "text/html",
"value": "The SFTP subsystem must be configured with the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>. The <tt>root</tt> option is not set by default."
"value": "<p>The SFTP subsystem must be configured with the <code>root</code> option in <code>ssh_sftpd:subsystem_spec/1</code>. The <code>root</code> option is not set by default.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "The SFTP subsystem must be configured with the `root` option in `ssh_sftpd:subsystem_spec/1`. The `root` option is not set by default."
}
],
"value": "The SFTP subsystem must be configured with the root option in ssh_sftpd:subsystem_spec/1. The root option is not set by default."
@@ -181,6 +212,7 @@
"value": "Jakub Witczak"
}
],
"datePublic": "2026-04-21T12:01:20.000Z",
"descriptions": [
{
"lang": "en",
@@ -188,10 +220,26 @@
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP <tt>ssh</tt> (<tt>ssh_sftpd</tt> module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.<p>The SFTP daemon (<tt>ssh_sftpd</tt>) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When <tt>SSH_FXP_FSETSTAT</tt> is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.</p><p>Any authenticated SFTP user on a server configured with the <tt>root</tt> option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.</p><p>If the SSH daemon runs as <tt>root</tt>, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.</p><p>This vulnerability is associated with program files <tt>lib/ssh/src/ssh_sftpd.erl</tt> and program routines <tt>ssh_sftpd:do_open/4</tt> and <tt>ssh_sftpd:handle_op/4</tt>.</p><p>This issue affects OTP from OTP 17.0 before OTP&nbsp;28.4.3, OTP&nbsp;27.3.4.11 and OTP&nbsp;26.2.5.20, corresponding to <tt>ssh</tt> from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15.</p>"
"value": "<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP <code>ssh</code> (<code>ssh_sftpd</code> module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.</p>\n<p>The SFTP daemon (<code>ssh_sftpd</code>) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When <code>SSH_FXP_FSETSTAT</code> is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.</p>\n<p>Any authenticated SFTP user on a server configured with the <code>root</code> option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.</p>\n<p>If the SSH daemon runs as <code>root</code>, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.</p>\n<p>This vulnerability is associated with program files <code>lib/ssh/src/ssh_sftpd.erl</code> and program routines <code>ssh_sftpd:do_open/4</code> and <code>ssh_sftpd:handle_op/4</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.20, OTP&nbsp;27.3.4.11, and OTP&nbsp;28.4.3, corresponding to ssh from 3.0.1 before 5.1.4.15, 5.2.11.7, and 5.5.2. Whether OTP before OTP&nbsp;17.0, corresponding to ssh before 3.0.1, is affected is unknown.</p>"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP `ssh` (`ssh_sftpd` module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (`ssh_sftpd`) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When `SSH_FXP_FSETSTAT` is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the `root` option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as `root`, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl` and program routines `ssh_sftpd:do_open/4` and `ssh_sftpd:handle_op/4`.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.20, OTP 27.3.4.11, and OTP 28.4.3, corresponding to ssh from 3.0.1 before 5.1.4.15, 5.2.11.7, and 5.5.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown."
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15."
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.\n\nIf the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.20, OTP 27.3.4.11, and OTP 28.4.3, corresponding to ssh from 3.0.1 before 5.1.4.15, 5.2.11.7, and 5.5.2. Whether OTP before OTP 17.0, corresponding to ssh before 3.0.1, is affected is unknown."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
@@ -205,7 +253,6 @@
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
@@ -234,7 +281,7 @@
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
@@ -244,10 +291,11 @@
"providerMetadata": {
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF",
"dateUpdated": "2026-07-24T14:14:17.633Z"
"dateUpdated": "2026-11-11T19:21:07.336Z"
},
"references": [
{
"name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot",
"tags": [
"vendor-advisory",
"related"
@@ -255,24 +303,35 @@
"url": "https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5"
},
{
"name": "EEF CNA record for CVE-2026-32147",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-32147.html"
},
{
"name": "OSV record EEF-CVE-2026-32147",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32147"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 07b8f44 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
},
{
"name": "Fix commit 28c5d5a in erlang/otp",
"tags": [
"patch"
],
@@ -290,15 +349,17 @@
{
"base64": false,
"type": "text/html",
"value": "<ul><li>Do not use the <tt>root</tt> option in <tt>ssh_sftpd:subsystem_spec/1</tt>, and instead rely on OS-level chroot or container isolation to confine SFTP users.</li><li>Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions.</li></ul>"
"value": "<ul>\n<li>Do not use the <code>root</code> option in <code>ssh_sftpd:subsystem_spec/1</code>, and instead rely on OS-level chroot or container isolation to confine SFTP users.</li>\n<li>Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions.</li>\n</ul>"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Do not use the `root` option in `ssh_sftpd:subsystem_spec/1`, and instead rely on OS-level chroot or container isolation to confine SFTP users.\n* Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions."
}
],
"value": "* Do not use the root option in ssh_sftpd:subsystem_spec/1, and instead rely on OS-level chroot or container isolation to confine SFTP users.\n* Ensure the Erlang VM is not running as a privileged OS user. Running the VM as an unprivileged user limits the impact of this vulnerability, since attribute modifications are constrained by that user's OS-level permissions."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
]
},
"adp": [
{
data/2026/62xxx/CVE-2026-62439.json
+3 -3
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-07-14T11:54:34.302Z",
"datePublished": "2026-10-16T21:54:49.538Z",
"dateUpdated": "2026-11-04T22:52:41.368Z"
"dateUpdated": "2026-11-11T19:45:59.579Z"
},
"containers": {
"cna": {
@@ -93,7 +93,7 @@
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gimp",
"defaultStatus": "affected",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
@@ -160,7 +160,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-04T22:52:41.368Z"
"dateUpdated": "2026-11-11T19:45:59.579Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/71xxx/CVE-2026-71298.json
+4 -4
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-05T14:50:01.309Z",
"datePublished": "2026-10-05T19:06:46.972Z",
"dateUpdated": "2026-10-06T16:53:28.584Z"
"dateUpdated": "2026-11-11T19:38:24.433Z"
},
"containers": {
"cna": {
@@ -92,14 +92,14 @@
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"description": "Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"x_redhatCweChain": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
"workarounds": [
{
"lang": "en",
@@ -121,7 +121,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-05T19:06:46.972Z"
"dateUpdated": "2026-11-11T19:38:24.433Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/91xxx/CVE-2026-91151.json
+187
View File
@@ -0,0 +1,187 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-91151",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2026-09-14T20:37:18.522Z",
"datePublished": "2026-11-11T19:46:14.718Z",
"dateUpdated": "2026-11-11T19:46:14.718Z"
},
"containers": {
"cna": {
"title": "Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel10",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-91151",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478404",
"name": "RHBZ#2478404",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"
},
{
"url": "https://github.com/cockpit-project/cockpit/releases/tag/372"
}
],
"datePublic": "2026-11-10T23:59:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access",
"timeline": [
{
"lang": "en",
"time": "2026-05-18T03:32:25.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-10T23:59:00.000Z",
"value": "Made public."
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-11T19:46:14.718Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
}
}
data/delta.json
+40 -15
View File
@@ -1,25 +1,50 @@
{
"fetchTime": "2026-11-11T19:20:17.698Z",
"numberOfChanges": 3,
"new": [],
"fetchTime": "2026-11-11T20:13:56.941Z",
"numberOfChanges": 7,
"new": [
{
"cveId": "CVE-2026-0323",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0323",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0323.json",
"dateUpdated": "2026-11-11T20:03:37.104Z"
},
{
"cveId": "CVE-2026-0324",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0324",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0324.json",
"dateUpdated": "2026-11-11T20:02:33.834Z"
},
{
"cveId": "CVE-2026-126815",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126815",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126815.json",
"dateUpdated": "2026-11-11T20:10:36.118Z"
}
],
"updated": [
{
"cveId": "CVE-2026-102010",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-102010",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102010.json",
"dateUpdated": "2026-11-11T19:17:05.819Z"
"cveId": "CVE-2024-12740",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-12740",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12740.json",
"dateUpdated": "2026-11-11T20:12:55.497Z"
},
{
"cveId": "CVE-2026-32148",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32148",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32148.json",
"dateUpdated": "2026-11-11T19:17:12.374Z"
"cveId": "CVE-2025-4748",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-4748",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/4xxx/CVE-2025-4748.json",
"dateUpdated": "2026-11-11T20:04:45.959Z"
},
{
"cveId": "CVE-2026-95619",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95619",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95619.json",
"dateUpdated": "2026-11-11T19:17:12.123Z"
"cveId": "CVE-2026-120730",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120730",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120730.json",
"dateUpdated": "2026-11-11T20:09:55.746Z"
},
{
"cveId": "CVE-2026-120999",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120999",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120999.json",
"dateUpdated": "2026-11-11T20:10:46.282Z"
}
],
"error": []
data/deltaLog.json
+304 -186
View File
@@ -1,4 +1,308 @@
[
{
"fetchTime": "2026-11-11T20:13:56.941Z",
"numberOfChanges": 7,
"new": [
{
"cveId": "CVE-2026-0323",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0323",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0323.json",
"dateUpdated": "2026-11-11T20:03:37.104Z"
},
{
"cveId": "CVE-2026-0324",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0324",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0324.json",
"dateUpdated": "2026-11-11T20:02:33.834Z"
},
{
"cveId": "CVE-2026-126815",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126815",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126815.json",
"dateUpdated": "2026-11-11T20:10:36.118Z"
}
],
"updated": [
{
"cveId": "CVE-2024-12740",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-12740",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12740.json",
"dateUpdated": "2026-11-11T20:12:55.497Z"
},
{
"cveId": "CVE-2025-4748",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-4748",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/4xxx/CVE-2025-4748.json",
"dateUpdated": "2026-11-11T20:04:45.959Z"
},
{
"cveId": "CVE-2026-120730",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120730",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120730.json",
"dateUpdated": "2026-11-11T20:09:55.746Z"
},
{
"cveId": "CVE-2026-120999",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120999",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120999.json",
"dateUpdated": "2026-11-11T20:10:46.282Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T20:01:47.944Z",
"numberOfChanges": 1,
"new": [],
"updated": [
{
"cveId": "CVE-2025-48038",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-48038",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48038.json",
"dateUpdated": "2026-11-11T19:58:02.263Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:55:56.215Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-0325",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0325",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0325.json",
"dateUpdated": "2026-11-11T19:51:55.386Z"
},
{
"cveId": "CVE-2026-0326",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0326",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0326.json",
"dateUpdated": "2026-11-11T19:50:29.708Z"
}
],
"updated": [
{
"cveId": "CVE-2025-48039",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-48039",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48039.json",
"dateUpdated": "2026-11-11T19:55:51.125Z"
},
{
"cveId": "CVE-2025-48040",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-48040",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48040.json",
"dateUpdated": "2026-11-11T19:53:34.489Z"
},
{
"cveId": "CVE-2025-48041",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-48041",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/48xxx/CVE-2025-48041.json",
"dateUpdated": "2026-11-11T19:51:38.902Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:50:12.577Z",
"numberOfChanges": 7,
"new": [
{
"cveId": "CVE-2026-0327",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0327",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0327.json",
"dateUpdated": "2026-11-11T19:48:39.698Z"
},
{
"cveId": "CVE-2026-0328",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0328",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0328.json",
"dateUpdated": "2026-11-11T19:45:53.014Z"
},
{
"cveId": "CVE-2026-91151",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-91151",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91151.json",
"dateUpdated": "2026-11-11T19:46:14.718Z"
}
],
"updated": [
{
"cveId": "CVE-2026-21620",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-21620",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21620.json",
"dateUpdated": "2026-11-11T19:48:42.293Z"
},
{
"cveId": "CVE-2026-23941",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-23941",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23941.json",
"dateUpdated": "2026-11-11T19:45:01.134Z"
},
{
"cveId": "CVE-2026-23943",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-23943",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23943.json",
"dateUpdated": "2026-11-11T19:44:14.524Z"
},
{
"cveId": "CVE-2026-62439",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-62439",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/62xxx/CVE-2026-62439.json",
"dateUpdated": "2026-11-11T19:45:59.579Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:44:09.608Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-0329",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0329",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0329.json",
"dateUpdated": "2026-11-11T19:39:54.302Z"
}
],
"updated": [
{
"cveId": "CVE-2026-124742",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124742",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124742.json",
"dateUpdated": "2026-11-11T19:38:47.003Z"
},
{
"cveId": "CVE-2026-23942",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-23942",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23942.json",
"dateUpdated": "2026-11-11T19:42:24.004Z"
},
{
"cveId": "CVE-2026-23943",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-23943",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23943.json",
"dateUpdated": "2026-11-11T19:39:40.465Z"
},
{
"cveId": "CVE-2026-71298",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71298",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71298.json",
"dateUpdated": "2026-11-11T19:38:24.433Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:38:24.142Z",
"numberOfChanges": 7,
"new": [
{
"cveId": "CVE-2026-0330",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0330",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0330.json",
"dateUpdated": "2026-11-11T19:37:07.716Z"
},
{
"cveId": "CVE-2026-0331",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-0331",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0331.json",
"dateUpdated": "2026-11-11T19:35:31.346Z"
},
{
"cveId": "CVE-2026-126784",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126784",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126784.json",
"dateUpdated": "2026-11-11T19:32:12.829Z"
}
],
"updated": [
{
"cveId": "CVE-2026-120286",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120286",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120286.json",
"dateUpdated": "2026-11-11T19:35:12.088Z"
},
{
"cveId": "CVE-2026-120295",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120295",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120295.json",
"dateUpdated": "2026-11-11T19:34:34.547Z"
},
{
"cveId": "CVE-2026-120997",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120997",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120997.json",
"dateUpdated": "2026-11-11T19:33:46.201Z"
},
{
"cveId": "CVE-2026-28806",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-28806",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28806.json",
"dateUpdated": "2026-11-11T19:36:02.122Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:32:07.023Z",
"numberOfChanges": 3,
"new": [],
"updated": [
{
"cveId": "CVE-2026-122095",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122095",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122095.json",
"dateUpdated": "2026-11-11T19:28:29.250Z"
},
{
"cveId": "CVE-2026-124746",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124746",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124746.json",
"dateUpdated": "2026-11-11T19:28:24.876Z"
},
{
"cveId": "CVE-2026-28810",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-28810",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28810.json",
"dateUpdated": "2026-11-11T19:28:21.075Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:26:09.996Z",
"numberOfChanges": 4,
"new": [
{
"cveId": "CVE-2026-122095",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-122095",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122095.json",
"dateUpdated": "2026-11-11T19:25:29.250Z"
}
],
"updated": [
{
"cveId": "CVE-2026-115456",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-115456",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115456.json",
"dateUpdated": "2026-11-11T19:24:21.584Z"
},
{
"cveId": "CVE-2026-32144",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32144",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32144.json",
"dateUpdated": "2026-11-11T19:24:15.856Z"
},
{
"cveId": "CVE-2026-32147",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-32147",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32147.json",
"dateUpdated": "2026-11-11T19:21:07.336Z"
}
],
"error": []
},
{
"fetchTime": "2026-11-11T19:20:17.698Z",
"numberOfChanges": 3,
@@ -848463,191 +848767,5 @@
}
],
"error": []
},
{
"fetchTime": "2026-10-12T19:59:44.518Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-104774",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104774",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104774.json",
"dateUpdated": "2026-10-12T19:58:39.383Z"
},
{
"cveId": "CVE-2026-109425",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109425",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109425.json",
"dateUpdated": "2026-10-12T19:55:37.215Z"
},
{
"cveId": "CVE-2026-41510",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-41510",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41510.json",
"dateUpdated": "2026-10-12T19:57:39.658Z"
}
],
"updated": [
{
"cveId": "CVE-2026-19654",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-19654",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19654.json",
"dateUpdated": "2026-10-12T19:58:58.382Z"
},
{
"cveId": "CVE-2026-78002",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78002",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78002.json",
"dateUpdated": "2026-10-12T19:59:09.247Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T19:53:26.268Z",
"numberOfChanges": 6,
"new": [
{
"cveId": "CVE-2026-108926",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108926",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108926.json",
"dateUpdated": "2026-10-12T19:45:10.670Z"
},
{
"cveId": "CVE-2026-95838",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95838",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95838.json",
"dateUpdated": "2026-10-12T19:53:24.599Z"
}
],
"updated": [
{
"cveId": "CVE-2025-49795",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-49795",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49795.json",
"dateUpdated": "2026-10-12T19:52:44.593Z"
},
{
"cveId": "CVE-2025-5914",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-5914",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/5xxx/CVE-2025-5914.json",
"dateUpdated": "2026-10-12T19:53:01.759Z"
},
{
"cveId": "CVE-2025-6020",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-6020",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6020.json",
"dateUpdated": "2026-10-12T19:52:51.583Z"
},
{
"cveId": "CVE-2025-6032",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-6032",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/6xxx/CVE-2025-6032.json",
"dateUpdated": "2026-10-12T19:53:07.271Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T19:44:11.541Z",
"numberOfChanges": 9,
"new": [
{
"cveId": "CVE-2021-48009",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2021-48009",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/48xxx/CVE-2021-48009.json",
"dateUpdated": "2026-10-12T19:35:23.798Z"
},
{
"cveId": "CVE-2026-109422",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109422",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109422.json",
"dateUpdated": "2026-10-12T19:33:32.062Z"
},
{
"cveId": "CVE-2026-109423",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109423",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109423.json",
"dateUpdated": "2026-10-12T19:34:31.770Z"
},
{
"cveId": "CVE-2026-109424",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109424",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109424.json",
"dateUpdated": "2026-10-12T19:35:20.198Z"
},
{
"cveId": "CVE-2026-109575",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109575",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109575.json",
"dateUpdated": "2026-10-12T19:36:10.947Z"
},
{
"cveId": "CVE-2026-95837",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-95837",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95837.json",
"dateUpdated": "2026-10-12T19:37:49.999Z"
}
],
"updated": [
{
"cveId": "CVE-2025-49794",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2025-49794",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49794.json",
"dateUpdated": "2026-10-12T19:39:18.607Z"
},
{
"cveId": "CVE-2026-66788",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-66788",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66788.json",
"dateUpdated": "2026-10-12T19:32:34.156Z"
},
{
"cveId": "CVE-2026-97058",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-97058",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97058.json",
"dateUpdated": "2026-10-12T19:33:32.335Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-12T19:31:16.108Z",
"numberOfChanges": 5,
"new": [
{
"cveId": "CVE-2026-104364",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-104364",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104364.json",
"dateUpdated": "2026-10-12T19:25:23.499Z"
},
{
"cveId": "CVE-2026-108924",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108924",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108924.json",
"dateUpdated": "2026-10-12T19:30:14.551Z"
},
{
"cveId": "CVE-2026-96012",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96012",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96012.json",
"dateUpdated": "2026-10-12T19:30:55.621Z"
}
],
"updated": [
{
"cveId": "CVE-2026-105465",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-105465",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105465.json",
"dateUpdated": "2026-10-12T19:22:20.473Z"
},
{
"cveId": "CVE-2026-78404",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-78404",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78404.json",
"dateUpdated": "2026-10-12T19:21:17.715Z"
}
],
"error": []
}
]
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "e837c189ec6ea3d81311ba14470ac266d207914b",
"upstream_commit": "41627ee2ef1e12fad3ca94db3782ad3357a41e4f",
"since_year": 2017,
"records": 331138,
"synced_at_utc": "2026-11-11T19:28:45.564331+00:00"
"records": 331151,
"synced_at_utc": "2026-11-11T21:04:45.683591+00:00"
}