Daniel Birtwhistle

A malicious or compromised HTTP/2 server can cause an application to crash by withholding a SETTINGS ACK and sending a RST STREAM on a completed stream to plant a null pointer. Subsequently, sending a PUSH PROMISE for that stream triggers a null pointer dereference within the `QNetworkAccessManager` class. A null pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to an immediate crash.

A use-after-free issue in the Qt Network module's HTTP/2 client support within QNetworkAccessManager allows a malicious or compromised HTTP/2 server to trigger a crash in the client application, impacting availability. Use-after-free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-reference accumulator for every resolved ID. This occurs within the `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` function and the corresponding implementation in `MapDeserializer`. If a document creates N unresolved object-ID references in an identity-enabled collection or map and subsequently defines those IDs in reverse order, the system performs quadratic CPU work during deserialization. This allows a shallow document to cause excessive CPU consumption through a high number of identity comparisons.

The ` findDeserializer()` function in `TypeDeserializerBase` caches resolved deserializers using the raw type ID provided by the user. In configurations using name-based polymorphism with a fallback, such as `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, each unique unrecognized type ID is stored as a separate key in the ` deserializers` map, even though they all resolve to the same fallback deserializer. Because this map lacks a configurable bound and persists for the lifetime of the type deserializer, an attacker can cause continuous memory retention by supplying numerous unique unknown type IDs. This issue occurs when an application enables name-based polymorphism with a `defaultImpl` or similar fallback, accepts user-influenced type IDs, and utilizes a long-lived `ObjectMapper` across requests.

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker. This action can occur before the connection authentication and authorization stage or at any time thereafter.

An integer underflow exists in the DHCPv4 packet capture code of the `wickedd-dhcp4` client. The function `ni capture inspect udp header()` in `src/capture.c` fails to verify that the IP total length field `ip len` is at least as large as the IP header length `ihl` before performing subtraction. An unauthenticated attacker on the same network can exploit this to trigger an out-of-bounds read past the receive buffer, potentially causing the daemon to crash depending on the process memory layout.

An out-of-bounds read exists in the DHCPv4 packet capture code. The function `ni capture inspect udp header()` in `src/capture.c` incorrectly reports the IP total length as the payload length instead of the remaining UDP payload length. This causes the DHCP option walker in the DHCPv4 client (`wickedd-dhcp4`) to read up to 68 bytes beyond the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to force the client to parse adjacent heap memory as DHCP options, potentially allowing heap contents like allocator metadata or pointer values to be interpreted as lease fields.

A heap-based buffer overflow in the dissection engine can lead to a crash, resulting in a denial of service. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially corrupting memory.

A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service.

A crash in the PEAK CAN TRC file parser can lead to a denial of service.