Jiajia Liu

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.27.0 **Description** The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during a request to initialize the process-wide GPU decode pool and submit video content that bypasses resource controls, resulting in a partial denial of service for concurrent requests. **Recommendations** Update vLLM to version 0.27.0 or later.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.20.0 through 1.25.1 **Description** An issue exists when the software is configured with `serve-expired: yes` and `serve-expired-client-timeout` is greater than `discard-timeout` (where `discard-timeout` is greater than 0). In this specific configuration, the `discard-timeout` branch within the serve expired logic drops an aged client reply without correctly decrementing the counter for the number of reply addresses for the query. Because the counter is not decremented, it can reach its maximum limit, causing new clients for duplicate in-flight queries to be silently dropped, which leads to a degradation of the resolution service. A malicious actor can trigger this by querying the resolver for a client-controlled slow-on-demand authoritative zone to push the counter past the threshold. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. Ensure that `serve-expired-client-timeout` is not configured to be greater than `discard-timeout` when `serve-expired` is enabled.

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.10.0 through 1.25.1 **Description** A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the `serve-expired: yes` setting is enabled alongside a `response-ip: <net> redirect` or `response-ip-data: <net> CNAME <target>` rule, or the equivalent `rpz-cname-override`. The issue stems from the `serve-expired-client-timeout()` function, which executes a two-pass loop to follow a CNAME alias generated by response-ip. During the second pass, the function resets the `alias rrset` variable but fails to reset `partial rep`, resulting in a NULL pointer dereference. An attacker can trigger this by controlling a zone that returns an A/AAAA record within the configured response-ip/rpz subnet and delaying the response after the previous record has expired. **Recommendations** Update NLnet Labs Unbound to a version later than 1.25.1. As a temporary mitigation, disable the `serve-expired: yes` setting or restrict the use of `response-ip` and `rpz-cname-override` rules.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** A validation mismatch between layers allows a remote unauthenticated attacker to crash the iApp process on port 36422 via SIGABRT. The issue occurs when the iApp receives an 'E42 RIC SUBSCRIPTION REQUEST' containing an empty `ricEventTriggerDefinition` field; while the E42 layer decoder accepts the empty field as valid, the E2AP encoder enforces a non-empty constraint when forwarding the request, leading to the crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** A reachable assertion in the `e2ap create pdu()` function is triggered when ASN.1 PER (Packed Encoding Rules, a binary encoding format for ASN.1 data) decoding fails. A remote unauthenticated attacker can send a non-PER byte sequence over SCTP to the near-RT RIC on port 36421 or the iApp on port 36422, causing the process to crash via SIGABRT. This occurs before any protocol-level validation takes place and affects E2AP protocol versions v1.01, v2.03, and v3.01. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** An issue exists where a `uint16 t` counter is used for `xapp id` assignment but is stored in `uint32 t` message fields. After more than 65,530 E42 SETUP REQUESTs, the 16-bit counter wraps around, resulting in duplicate `xapp ids`. This causes the iApp (port 36422) to crash when it attempts to register a duplicate ID within its internal data structure. A remote attacker can trigger this crash by repeatedly connecting and requesting new xApp registrations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** An issue exists where the software trusts the `xapp id` field from E42 message payloads without binding it to the sender's SCTP association. The validation function `valid xapp id()` only verifies that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying a target `xapp id` in requests sent to the iApp endpoint on port 36422. This leads to responses being misrouted to the victim xApp, which can cause the victim xApp, the RIC, or the iApp to crash due to state inconsistencies in the red-black tree data structure, a self-balancing binary search tree used for efficient data storage and retrieval. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** The near-RT RIC contains reachable `assert(0)` calls within stub message handlers for E2AP message types that are whitelisted but not yet implemented. A remote unauthenticated attacker can cause the near-RT RIC process on port 36421 to crash via SIGABRT by sending a decodable E2AP PDU of an unimplemented type, such as `E2nodeConfigurationUpdate`. The message successfully passes whitelist validation but triggers an unconditional assertion in the handler. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** The iApp message dispatcher contains a reachable assertion. The dispatcher uses the `assert()` function to validate incoming E2AP messages against a 9-entry whitelist. A remote unauthenticated attacker can send a decodable E2AP PDU with a message type not present in the whitelist, triggering a SIGABRT (a signal sent to a process to force it to abort) and crashing the iApp process on port 36422. Because iApp and the near-RT RIC share a single process, this action terminates the entire RIC service, resulting in the disconnection of all xApps and E2 Nodes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlexRIC version 2.0.0 **Description** The iApp process on port 36421 crashes when it receives a duplicate E2 SETUP REQUEST from the same or a spoofed E2 Node. This occurs because the iApp registry uses an `assert()` function to enforce node ID uniqueness instead of implementing a controlled rejection. A remote unauthenticated attacker can trigger a SIGABRT (a signal sent to a process to force it to abort) by sending two E2 SETUP REQUESTs with identical E2 node configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions up to 2.7.2 **Description** A vulnerability was found in the function `amf nsmf pdusession handle update sm context` of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This issue allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. **Recommendations** To resolve the issue, apply a patch to fix this problem. As a temporary workaround, consider restricting access to the vulnerable function `amf nsmf pdusession handle update sm context` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Open5GS versions up to 2.7.2 **Description** A denial of service issue has been found in the `gmm state authentication` function of the file `src/amf/gmm-sm.c` in the component AMF. This issue can be exploited remotely, leading to a network-wide outage, causing all registered UEs to lose connectivity, and blocking new registrations until the AMF is restarted. The exploit has been disclosed to the public and may be used. **Recommendations** To fix this issue, apply the patch named `e31e9965f00d9c744a7f728497cb4f3e97744ee8` to the affected Open5GS version. As a temporary workaround, consider restricting access to the `gmm state authentication` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** CSAPP Lab (affected versions not specified) **Description** The issue allows a remote attacker to execute arbitrary code via the lab3 of csapp, lab3/buflab-update.pl component. This is a Buffer Overflow vulnerability in CSAPP Lab CSAPP Lab3 15-213 Fall 20xx. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.