Xint Code

An externally-controlled format string in the `timeofday()` function allows an attacker to retrieve portions of server memory by using crafted timezone zones.

An out-of-bounds write issue exists due to insufficient input validation. This flaw allows an application to write to kernel memory or cause unexpected system termination.

An authenticated attacker can trigger a use-after-free condition in the unblock client flow when a blocked client is evicted. This occurs because the system does not properly handle an error return from the `processCommandAndResetClient()` function when re-executing a blocked command. This flaw can be exploited to execute arbitrary OS commands on the server. The exploitation chain involves using a Lua script to leak a heap pointer, grooming client memory, and overwriting a function pointer in the Global Offset Table to redirect a standard string function to `system()`. This issue was present in all stable branches for over two years and is particularly critical for default deployments that lack passwords or use overly permissive roles.

A WebFlux server application that processes multipart requests creates temporary files for parts larger than 10 K. Under certain conditions, these temporary files may not be deleted after the request is fully processed, which allows an attacker to consume available disk space.