Vulnerabilities

Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding.<br /> <br /> hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. &amp;#39;Elixir.HPAX.Types&amp;#39;:decode_remaining_integer/3 accumulates the integer as int + (value

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.<br /> <br /> Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.<br /> <br /> This vulnerability is associated with program files lib/mint/http1.ex and program routines &amp;#39;Elixir.Mint.HTTP1&amp;#39;:decode_body/5, &amp;#39;Elixir.Mint.HTTP1&amp;#39;:add_body_to_buffer/2.<br /> <br /> When Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection&amp;#39;s data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client&amp;#39;s memory arbitrarily high and trigger an out-of-memory condition.<br /> <br /> This issue affects mint: from 0.5.0 before 1.9.1.

Apache Airflow&amp;#39;s Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.

Improper Input Validation vulnerability in Apache Camel.<br /> <br /> This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0.<br /> <br /> Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

Improper Input Validation vulnerability in Apache Camel.<br /> <br /> This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.<br /> <br /> Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

Improper Input Validation vulnerability in Apache Camel.<br /> <br /> This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.<br /> <br /> Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

Missing filtering when the helmRepoURLRegex field isn&amp;#39;t set on a GitRepo resource in SUSE Rancher Fleet&amp;#39;s bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user&amp;#39;s browser. This condition allows an attacker to inject malicious script content into pages served by the application.<br /> <br /> By leveraging this weakness, an attacker can cause the user&amp;#39;s browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.