Hyunwoo Kim

The `ws read frame()` function incorrectly unmasks WebSocket payloads by iterating `wsh->datalen`, which includes frame headers, while indexing from the payload pointer. A masked frame that fills the 64 KiB receive buffer can cause an XOR operation to occur up to 14 bytes beyond the buffer, and in cases of exact capacity, a terminating NUL is written one byte out of bounds. This issue is reachable before authentication if `mod xml rpc` and its opt-in WebSocket endpoint are enabled. These features are disabled by default in the stock configuration. The writes occur within the same connection handle's adjacent outbound buffer.

The `switch event expand headers check()` function fails to properly validate the offset in `${variable:offset}` when it exceeds the length of the variable value. This allows the system to read beyond the heap copy, appending adjacent heap memory to the expansion result. This behavior can expose sensitive information such as channel variables, credentials, allocator data, and pointer bytes. The issue is reachable via configuration templates that slice remote input and through authenticated Event Socket `eval` or Event Socket `expand` commands.

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.  An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.

An issue involving path traversal occurs due to insufficient path validation. This flaw allows a malicious application to delete files for which it does not have the necessary privileges. Path traversal is a technique used to access files and directories that are stored outside the intended folder.

A kernel vulnerability exists where an application may be able to leak sensitive kernel state. This issue is caused by insufficient input sanitization.

Insufficient input sanitization in Apple platforms allows a locally running app to reach sensitive kernel code paths. This improper input validation can lead to memory corruption, enabling an attacker to cause unexpected system termination or write to kernel memory. Such exploitation may lead to privilege escalation or full device compromise. Real-world incidents indicate that this issue is being chained with WebKit exploits to escalate from browser-based code execution to full system control.

A use-after-free flaw exists in the x86 shadow MMU (Memory Management Unit) of the Kernel-based Virtual Machine (KVM) subsystem. The issue occurs in the `rmap remove()` function when a shadow paging mismatch occurs between stored and computed Guest Frame Numbers (GFNs). Specifically, if a modified Page Directory Entry (PDE) points to a non-leaf page, the `kvm mmu get child sp()` function fails to compare the role of the page and reuses it. When a memslot is dropped, the shadow page is freed, but the rmap entry survives. Subsequent operations, such as dirty logging or MMU notifier invalidation, dereference a pointer to the freed page. This can be exploited by a guest VM with root privileges to cause a host kernel panic (denial of service) or achieve guest-to-host escape to execute arbitrary code with root privileges on the host. The flaw affects both Intel and AMD CPUs and has been present in the kernel for approximately 16 years.

Improper Control of Generation of Code allows for code injection within the email services of the software.

A flaw in the RxRPC networking subsystem occurs when a socket buffer carrying a page-cache reference reaches the authentication verification path. The kernel performs in-place decryption directly on the referenced page without isolating the buffer. This happens because the DATA-packet handler in `rxrpc input call event()` and the RESPONSE handler in `rxrpc verify response()` only copy the socket buffer to a linear one when `skb cloned()` is true, failing to account for buffers that are not cloned but contain externally-owned paged fragments. A low-privileged local attacker can exploit this to corrupt page-cache contents of readable files, such as `/etc/passwd`, potentially obtaining root privileges. This issue may also lead to a denial of service.

Various `FilterExpressionConverter` implementations fail to properly escape keys and values when translating filter expression objects into specific vector store query languages. This improper escaping allows for query injection, which can enable attackers to alter vector store queries, potentially leading to data exposure and tampering.

A flaw in the Camel-Mail component allows an attacker to perform message header injection by sending a specially crafted email to a mailbox monitored by a Camel application. Due to a missing inbound filter in the `MailHeaderFilterStrategy`, malicious headers are not properly filtered, which can alter the behavior of downstream components. This issue involves the `setOutFilterStartsWith()` function and deficiencies in the deserialization mechanism, potentially leading to remote code execution (RCE), where an attacker can execute arbitrary code on the system.

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) Description The Linux kernel contains a flaw in its netfilter component related to conntrack and missing netlink policy validations. Specifically, the `nlattr to sctp()` function improperly handles user-supplied `CTA PROTOINFO SCTP STATE` values, potentially leading to an out-of-bounds access. This issue can occur when processing netlink attributes without proper validation, resulting in a slab-out-of-bounds read. The vulnerability affects the `ctnetlink` functionality. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Spring Cloud versions 3.1.X through 3.1.12, 4.1.X through 4.1.8, 4.2.X through 4.2.2, 4.3.X through 4.3.1, and 5.0.X through 5.0.1. Description: A flaw exists in Spring Cloud Config when substituting the profile parameter from a request to the Spring Cloud Config Server configured to use the native file system as a backend. This allows an attacker to access files outside of the configured search directories. The issue is due to improper path restriction. Recommendations: Update Spring Cloud to version 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2.

The camel-coap component is susceptible to message header injection. The `CamelCoapResource.handleRequest()` function iterates over `OptionSet.getUriQuery()` and calls `camelExchange.getIn().setHeader(...)` for every query parameter without applying a HeaderFilterStrategy. This allows an unauthenticated remote attacker to inject arbitrary internal headers (prefixed with Camel*) by sending a single CoAP UDP packet to a route consuming from 'coap://'. If the route forwards the request to header-sensitive producers such as 'camel-exec', 'camel-sql', 'camel-bean', 'camel-file', or template components ('camel-freemarker', 'camel-velocity'), the injected headers can alter the producer's behavior. Specifically, using 'camel-exec', the `CamelExecCommandExecutable` and `CamelExecCommandArgs` headers can override configured settings to achieve arbitrary OS command execution under the privileges of the Camel process. The output is returned in the CoAP response payload, providing an interactive remote code execution channel.

The issue is related to a NULL pointer dereference in the Linux kernel's vsock/virtio module. This can occur when the socket has been de-assigned or assigned to another transport, and packets are received that are not expected, causing issues when accessing `vsk->transport`. A possible scenario involves a first connect() interrupted by a signal, and a second connect() failed, leading to `vsk->transport` being NULL.

A vulnerability has been resolved in the Linux kernel related to the hv sock module. The issue arises when the `vsk->trans` variable is not initialized to NULL upon the release of hvs, potentially leading to a dangling pointer. This problem is addressed by ensuring `vsk->trans` is initialized to NULL.

The issue is related to the initialization of a dangling pointer in the vsock/virtio module, potentially leading to a Use-After-Free condition. This could allow an attacker to cause a denial of service or possibly execute arbitrary code. The vulnerability is resolved by initializing the pointer to NULL. It is estimated that over 55.7 million services may be affected. The vulnerability has been exploited in real-world incidents, including a demonstration at Zer0Con 2025 using the kernel-hack-drill open-source project.

The issue is related to a use after free (UAF) vulnerability in the Linux kernel. It occurs when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by another ingress or clsact instance, causing the tcx entry to be released too early. The sequence to trigger the UAF involves creating a network namespace, allocating a tcx entry, and then replacing the qdisc, which frees the previously linked tcx entry. Later, when the network namespace is closed, it accesses the already freed tcx entry, leading to the UAF. The correct fix is to turn the miniq active boolean into a counter, ensuring the tcx entry is freed at the correct time.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a Use-After-Free vulnerability in the `gtp dellink` function. This vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information. The problem arises because `call rcu`, which is called in the `hlist for each entry rcu` traversal of `gtp dellink`, is not part of the RCU read critical section. As a result, the RCU grace period may pass during the traversal, and the key may be freed. To prevent this, it should be changed to `hlist for each entry safe`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a Use-After-Free vulnerability in the `ovs ct limit exit()` function in the Linux kernel's net/openvswitch/conntrack.c module. This vulnerability can be exploited to cause a denial of service. The problem arises because `kfree rcu`, which is called in the `hlist for each entry rcu` traversal of `ovs ct limit exit`, is not part of the RCU read critical section, allowing the RCU grace period to pass during the traversal and the key to be freed. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.