Waydeshi

An issue exists where `JSONTokener.nextSimpleValue` can accumulate unbounded numeric tokens before `JSONObject.stringToNumber` passes them to BigInteger or BigDecimal conversion without a length limit. Applications parsing attacker-controlled JSON or XML through `JSONObject`, `JSONArray`, or `XML.toJSONObject` may experience super-linear CPU consumption when converting excessively long numeric literals. This can block request-handling threads and lead to a denial of service. This behavior persists regardless of the strict mode and keep-strings settings in `JSONParserConfiguration`.

A reference leak exists in the C extension of the multidict data structure. The issue occurs during the items-view reflected union operation, `operand | d.items()`, within the `multidict itemsview or2 impl` function, and the subtraction operation, `d.items() - operand`, within the `multidict itemsview sub1 impl` function. These operations fail to release new key-identity and value references for each operand element. If an application performs these operations using sequences influenced by an attacker, it can lead to the leak of two strong references per element. Because garbage collection cannot reclaim these references, repeated operations may result in unbounded process memory growth, leading to a denial of service. Pure-Python builds, forward union, intersection, and non-tuple operand elements are not affected.

The `isInSubnet()` and `isHostInSubnet()` functions in `src/common.ts` compare masked binary strings without verifying if both operands belong to the same IP family. This allows a cross-family containment check to return a match if the leading address bits are identical, despite IPv4 and IPv6 occupying different address spaces. Consequently, an allowlist or denylist may incorrectly classify an address as being within the intended range.

The `Address6` constructor, `Address6.isValid` function, and the `parse` code in `src/ipv6.ts` accept unbounded strings. When invalid characters are processed through `RE BAD CHARACTERS`, they are expanded into large diagnostics. This can lead to a synchronous stall and high transient memory usage when processing megabyte-scale fields. Specifically, fields of approximately 16 MiB can trigger an invalid string length exception, and fields of approximately 32 MiB can cause process termination. This occurs when an application passes a very large attacker-controlled field to the parsing logic without a prior length bound.

An issue exists when binding a JSON string to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` field via the `CoreXMLDeserializers.Std. deserialize` function. The software passes the raw string directly to `DatatypeFactory.newDuration(value)` or `newXMLGregorianCalendar(value)`. Because the XML Schema lexical grammar allows numeric components of arbitrary length, the JDK uses `BigInteger(String)` and `BigDecimal(String)` constructors, which have quadratic complexity relative to the digit count. Since the input is treated as a JSON string rather than a JSON number, the `StreamReadConstraints.maxNumberLength` guard is bypassed, and the XML datatype deserializer fails to perform length validation. An unauthenticated attacker can send a request containing a string with several million digits, causing excessive CPU consumption and potentially saturating server worker threads.

The built-in prompt and resource controllers lack role checking. The endpoints 'POST /api/prompts*' and 'PUT /api/prompts*', as well as 'POST /api/resources*' and 'PUT /api/resources*', are accessible to authenticated users without administrative privileges because the handlers do not verify the `req.user` variable. Since the DAO singletons are prioritized over connected MCP servers in the `handleGetPromptRequest()` and `handleReadResourceRequest()` functions, a non-admin user can create, overwrite, or shadow global prompt templates and resources. This leads to an unauthorized integrity violation and can result in stored prompt injection into the LLM sessions of other users.

The PUT '/api/system-config' endpoint (handler `updateSystemConfig`) lacks an authorization check. While the endpoint is protected by authentication middleware and a rate limiter, it fails to verify if the user has administrative privileges by not inspecting the `req.user.isAdmin` variable.

The `qs.stringify` function can throw a `TypeError` when serializing an object that contains a `constructor` property with a truthy, non-callable `isBuffer` member. This occurs because the `utils.isBuffer()` function performs duck-typing by invoking `obj.constructor.isBuffer(obj)` without first verifying that `isBuffer` is actually a function. An attacker can trigger this by providing specially crafted input via `qs.parse` (using `plainObjects: true` or `allowPrototypes: true`) or through `JSON.parse`. In environments like Express 4 or body-parser with `extended: true`, such input can be passed directly through `req.query` or `req.body`. This can lead to a denial of service where the affected request returns a 500 error, or in cases where the call occurs outside an error boundary (such as in an `async` handler), it may cause the entire process to exit.

The deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In the `JDKFromStringDeserializer.NioPathHelper.deserialize` function, a string from untrusted JSON is passed to `new URI(value)` and then to `Path.of(uri)`. If a `FileSystemNotFoundException` occurs, the code enumerates `ServiceLoader<FileSystemProvider>` and calls `provider.getPath(uri)` on the first provider matching the attacker-chosen scheme. This allows untrusted JSON to select and drive an arbitrary registered `FileSystemProvider` during `readValue` under a default `JsonMapper`, forcing provider class loading. While the resolved path is inert with only JDK built-in providers (file, jar/zipfs), further impact is possible if a side-effecting third-party `FileSystemProvider` is present on the classpath.