Z3R0S6

An out-of-bounds read exists in the sender-side block matching logic. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. This causes a negative offset calculation during delta computation, leading to an out-of-bounds read of file data buffer memory on the sender side.

A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a `/./` boundary marker, enabling the construction of paths that resolve outside the chroot boundary. Attackers can exploit the improper handling of the `/./` notation or forge delta-basis transfers referencing xname paths that cross the `/./` boundary to obtain unauthorized read or write access to files outside the module's subtree.

A signed integer overflow exists in the I/O timeout implementation. An attacker can inject `MSG IO TIMEOUT` messages containing non-positive values (zero or negative), causing the timeout variable to wrap. This prevents the timeout check from triggering, allowing idle or stalled connections to occupy daemon slots indefinitely, which results in resource exhaustion.

An authorization bypass exists in the web-level attachment endpoints where access control for draft releases is not enforced. While the API endpoints correctly restrict draft release access to users with write permissions, the web-side handler `ServeAttachment()` only checks for repository-level read permissions. This allows any user, including unauthenticated anonymous callers, to download the full contents of an attachment if they obtain its UUID. This issue affects the following endpoints: - `/attachments/{uuid}` - `/{owner}/{repo}/attachments/{uuid}` - `/{owner}/{repo}/releases/attachments/{uuid}` The vulnerability can be exploited if a UUID is leaked through side channels such as browser history, server logs, email, or public links. This may lead to the disclosure of sensitive information, including pre-release binaries, security-fix candidates, internal SBOMs, or draft release notes.