Common Weakness Enumeration
CWE-1250
AllowedImproper Preservation of Consistency Between Independent Representations of Shared State
Abstraction: Base · Status: Incomplete
The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
11 vulnerabilities reference this CWE, most recent first.
CVE-2026-14666 (GCVE-0-2026-14666)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07
VLAI
EPSS
VEX
Title
PostgreSQL row security caching disregards role modifications
Summary
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:53 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.6
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:53:54.547151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:34:56.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.6",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "application uses row security policies that react to the current role, and application modifies roles to change the applicable policies"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Staroverov Ilja and Shinya Kato for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application\u0027s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T23:07:13.583Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14666/"
}
],
"title": "PostgreSQL row security caching disregards role modifications",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14666",
"datePublished": "2026-08-13T13:00:03.720Z",
"dateReserved": "2026-07-03T20:28:10.229Z",
"dateUpdated": "2026-08-29T23:07:13.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0235
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:15
VLAI
EPSS
VEX
Title
Dovecot Security Advisory OXDC-2026-0001
Summary
Dear subscribers,
we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory is also published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
---
Classification: TLP:GREEN
Internal reference: DOV-7830
Type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot CE core 2.4.1
Discovery date: 2025-07-24
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: Erik <erik () broadlux com>
CVE: CVE-2025-30189
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Details:
v2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers
incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.
Risk:
After cached login, all subsequent logins are for same user. No publicly available exploits are known.
Solution:
Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers.
---
Internal reference: DOV-8349
Type: CWE-20 (Improper Input Validation)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3
Discovery date: 2025-11-04
Solution date: 2026-03-27
Disclosure date: 2026-03-27
CVE: CVE-2025-59028
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Details:
Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is
disconnected from the auth server, causing all active authentication sessions to fail.
Risk:
Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits
are known.
Solution:
Install fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments).
---
Internal reference: DOV-8508
Type: CWE-20 (Improper Input Validation)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3
Discovery date: 2025-11-29
Solution date: 2026-03-27
Disclosure date: 2026-03-27
CVE: CVE-2025-59032
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Details:
v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE
command crashes when using literal as SASL initial response.
Risk:
This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available
exploits are known.
Solution:
Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed version.
---
Internal reference: DOV-8584
Type: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1
Discovery date: 2025-12-29
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: cavid@yeswehack
CVE: CVE-2025-59031
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Details:
decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a
script to use for attachment to text conversion. This script unsafely handles zip-style attachments.
Risk:
Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and
subsequently ending up in FTS indexes. No publicly available exploits are known.
Solution:
Do not use the provided script, instead, use something else like FTS tika.
---
Internal reference: DOV-8591
Type: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
Discovery date: 2026-01-07
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: strokep@yeswehack
CVE: CVE-2026-0394
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Details:
auth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth
path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot
has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has
been added to allowed characters, path traversal can happen if the domain component is directory partial.
Risk:
This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains
passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear
valid users. No publicly available exploits are known.
Solution:
Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can
also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d.
---
Internal reference: DOV-8775
Type: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4
Discovery date: 2026-02-20
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: cookiejack15@yeswehack
CVE: CVE-2026-27860
CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Details:
v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject
arbitrary LDAP filter to Dovecot's LDAP authentication.
Risk:
This leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits
are known.
Solution:
Do not clear out auth_username_chars, or install fixed version.
---
Internal reference: DOV-8781
Type: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4
Discovery date: 2026-02-23
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: whisperer@yeswehack
CVE: CVE-2026-24031
CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)
Details:
v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed
when auth_username_chars is cleared by admin.
Risk:
This vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits
are known.
Solution:
Do not clear auth_username_chars. If this is not possible, install latest fixed version.
---
Internal reference: DOV-8787
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4
Discovery date: 2026-02-24
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: djvirus@yeswehack
CVE: CVE-2026-27859
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Details:
v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing
excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.
Risk:
A suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly
available exploits are known.
Solution:
Use MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the
processing is limited.
---
Internal reference: DOV-8816
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro
core 2.3.22.1
Discovery date: 2026-02-27
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: whisperer@yeswehack
CVE: CVE-2026-27857
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Details:
imap-login: Excessive memory usage DoS. Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in
~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for
longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and
create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the
process and its other proxied connections.
Risk:
Attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which
would likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly
available exploits are known.
Solution:
Install fixed version, there is no other remediation.
---
Internal reference: DOV-8818
Type: CWE-400 (Uncontrolled Resource Consumption)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0
First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro
core 2.3.22.1
Discovery date: 2026-02-28
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: ilyar@yeswehack
CVE: CVE-2026-27858
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Details:
managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes
managesieve to allocate large amount of memory.
Risk:
Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available
exploits are known.
Solution:
Protect access to managesieve protocol, or install fixed version.
---
Internal reference: DOV-8830
Type: CWE-287 (Improper Authentication)
Component: core
Report confidence: Confirmed
Solution status: Fixed by vendor
Last affected revision: OX Dovecot Pro core 2.3.0
First fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro
core 2.3.22.1
Discovery date: 2026-03-04
Solution date: 2026-03-27
Disclosure date: 2026-03-27
Researcher credits: bksparajuli@yeswehack
CVE: CVE-2026-27856
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Details:
doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is
susceptible to timing oracle attack. An attacker can use this to determine the configured credentials.
Risk:
Figuring out the credential will le
Severity
No CVSS data available.
Assigner
References
5 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dovecot | Security Advisory |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0235 (this record)
- related CVE-2025-30189
- related CVE-2025-59028
- related CVE-2025-59031
- related CVE-2025-59032
- related CVE-2026-0394
- related CVE-2026-24031
- related CVE-2026-27855
- related CVE-2026-27856
- related CVE-2026-27857
- related CVE-2026-27858
- related CVE-2026-27859
- related CVE-2026-27860
{
"containers": {
"cna": {
"affected": [
{
"product": "Security Advisory",
"vendor": "Dovecot",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aki Tuomi"
}
],
"descriptions": [
{
"lang": "en",
"value": "Dear subscribers,\n\nwe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html\n\n\n---\n\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-7830\nType: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.1\nDiscovery date: 2025-07-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: Erik \u003cerik () broadlux com\u003e\nCVE: CVE-2025-30189\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nv2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers \nincorrectly cache all users with same cache key, causing wrong cached information to be used for these users.\n\nRisk:\nAfter cached login, all subsequent logins are for same user. No publicly available exploits are known.\n\nSolution:\nInstall fixed version or disable caching either globally or for the impacted passdb/userdb drivers.\n\n\n\n---\n\n\n\nInternal reference: DOV-8349\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3\nDiscovery date: 2025-11-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59028\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nInvalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is \ndisconnected from the auth server, causing all active authentication sessions to fail.\n\nRisk:\nInvalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments).\n\n\n\n---\n\n\n\nInternal reference: DOV-8508\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3\nDiscovery date: 2025-11-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59032\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nv2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE \ncommand crashes when using literal as SASL initial response.\n\nRisk:\nThis can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available \nexploits are known.\n\nSolution:\nControl access to ManageSieve port, or disable the service if it\u0027s not needed. Alternatively upgrade to a fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8584\nType: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1\nDiscovery date: 2025-12-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cavid@yeswehack\nCVE: CVE-2025-59031\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\ndecode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a \nscript to use for attachment to text conversion. This script unsafely handles zip-style attachments.\n\nRisk:\nAttacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and \nsubsequently ending up in FTS indexes. No publicly available exploits are known.\n\nSolution:\nDo not use the provided script, instead, use something else like FTS tika.\n\n\n\n---\n\n\n\nInternal reference: DOV-8591\nType: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nDiscovery date: 2026-01-07\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: strokep@yeswehack\nCVE: CVE-2026-0394\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nauth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth \npath traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot \nhas been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has \nbeen added to allowed characters, path traversal can happen if the domain component is directory partial.\n\nRisk:\nThis allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains \npasswords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear \nvalid users. No publicly available exploits are known.\n\nSolution:\nUpgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can \nalso ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d.\n\n\n\n---\n\n\n\nInternal reference: DOV-8775\nType: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-20\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cookiejack15@yeswehack\nCVE: CVE-2026-27860\nCVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nv2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject \narbitrary LDAP filter to Dovecot\u0027s LDAP authentication.\n\nRisk:\nThis leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits \nare known.\n\nSolution:\nDo not clear out auth_username_chars, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8781\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-23\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-24031\nCVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)\n\nDetails:\nv2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed \nwhen auth_username_chars is cleared by admin.\n\nRisk:\nThis vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits \nare known.\n\nSolution:\nDo not clear auth_username_chars. If this is not possible, install latest fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8787\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-27859\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nv3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing \nexcessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.\n\nRisk:\nA suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly \navailable exploits are known.\n\nSolution:\nUse MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the \nprocessing is limited.\n\n\n\n---\n\n\n\nInternal reference: DOV-8816\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-27\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-27857\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS. Sending \"NOOP (((...)))\" command with 4000 parenthesis open+close results in \n~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for \nlonger time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and \ncreate 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the \nprocess and its other proxied connections.\n\nRisk:\nAttacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which \nwould likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version, there is no other remediation.\n\n\n\n---\n\n\n\nInternal reference: DOV-8818\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-28\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-27858\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes \nmanagesieve to allocate large amount of memory.\n\n\nRisk:\nAttacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available \nexploits are known.\n\nSolution:\nProtect access to managesieve protocol, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8830\nType: CWE-287 (Improper Authentication)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-03-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: bksparajuli@yeswehack\nCVE: CVE-2026-27856\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\ndoveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is \nsusceptible to timing oracle attack. An attacker can use this to determine the configured credentials.\n\nRisk:\nFiguring out the credential will le"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "CWE-1250",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-287",
"description": "CWE-287",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-294",
"description": "CWE-294",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-90",
"description": "CWE-90",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:15:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/13"
},
{
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/13"
],
"discovery": "EXTERNAL"
},
"title": "Dovecot Security Advisory OXDC-2026-0001",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-30189",
"type": "related"
},
{
"destId": "CVE-2025-59028",
"type": "related"
},
{
"destId": "CVE-2025-59031",
"type": "related"
},
{
"destId": "CVE-2025-59032",
"type": "related"
},
{
"destId": "CVE-2026-0394",
"type": "related"
},
{
"destId": "CVE-2026-24031",
"type": "related"
},
{
"destId": "CVE-2026-27855",
"type": "related"
},
{
"destId": "CVE-2026-27856",
"type": "related"
},
{
"destId": "CVE-2026-27857",
"type": "related"
},
{
"destId": "CVE-2026-27858",
"type": "related"
},
{
"destId": "CVE-2026-27859",
"type": "related"
},
{
"destId": "CVE-2026-27860",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0235",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13",
"automated": true,
"contentSha256": "cd1c4fc48637eb40c941400f57d5835f8f7b88c32c348352184aedfe5768d08a",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/13",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-27T08:06:15Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0235"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:41Z",
"dateUpdated": "2026-09-11T11:15:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0235"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-32899 (GCVE-0-2025-32899)
Vulnerability from cvelistv5 – Published: 2025-12-05 00:00 – Updated: 2025-12-05 14:34
VLAI
EPSS
VEX
Summary
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-05 14:34 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KDE | KDEConnect |
Affected:
0 , < 1.33.0
(custom)
cpe:2.3:a:kde:kdeconnect:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-32899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-05T14:34:37.226563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T14:34:45.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "KDEConnect",
"vendor": "KDE",
"versions": [
{
"lessThan": "1.33.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kde:kdeconnect:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T04:45:51.898Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://kdeconnect.kde.org"
},
{
"url": "https://kde.org/info/security/advisory-20250418-1.txt"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-32899",
"datePublished": "2025-12-05T00:00:00.000Z",
"dateReserved": "2025-04-14T00:00:00.000Z",
"dateUpdated": "2025-12-05T14:34:45.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30189 (GCVE-0-2025-30189)
Vulnerability from cvelistv5 – Published: 2025-10-31 09:02 – Updated: 2026-03-27 12:33
VLAI
EPSS
VEX
Summary
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-31 18:29 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro |
Affected:
0 , ≤ 3.1.0
(semver)
Affected: 0 , ≤ 2.4.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:57.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/29"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/10/29/4"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30189",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-31T18:29:20.964859Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-31T18:37:37.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"core"
],
"product": "OX Dovecot Pro",
"vendor": "Open-Xchange GmbH",
"versions": [
{
"lessThanOrEqual": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T12:33:18.387Z",
"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
"shortName": "OX"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"
}
],
"source": {
"defect": "DOV-7830",
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981",
"assignerShortName": "OX",
"cveId": "CVE-2025-30189",
"datePublished": "2025-10-31T09:02:33.273Z",
"dateReserved": "2025-03-18T08:39:46.884Z",
"dateUpdated": "2026-03-27T12:33:18.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10976 (GCVE-0-2024-10976)
Vulnerability from cvelistv5 – Published: 2024-11-14 13:00 – Updated: 2025-11-03 21:51
VLAI
EPSS
VEX
Title
PostgreSQL row security below e.g. subqueries disregards user ID changes
Summary
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 18:53 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
17 , < 17.1
(rpm)
Affected: 16 , < 16.5 (rpm) Affected: 15 , < 15.9 (rpm) Affected: 14 , < 14.14 (rpm) Affected: 13 , < 13.17 (rpm) Affected: 0 , < 12.21 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10976",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T18:53:41.183245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T19:32:17.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:51:36.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://security.netapp.com/advisory/ntap-20250509-0010/"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "17.1",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.5",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.9",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.14",
"status": "affected",
"version": "14",
"versionType": "rpm"
},
{
"lessThan": "13.17",
"status": "affected",
"version": "13",
"versionType": "rpm"
},
{
"lessThan": "12.21",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "application uses row security policies that react to the current role, and one database session reaches the same query via multiple roles"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Wolfgang Walther for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application\u0027s pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T13:00:01.930Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2024-10976/"
}
],
"title": "PostgreSQL row security below e.g. subqueries disregards user ID changes"
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2024-10976",
"datePublished": "2024-11-14T13:00:01.930Z",
"dateReserved": "2024-11-07T19:27:02.623Z",
"dateUpdated": "2025-11-03T21:51:36.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-22405 (GCVE-0-2023-22405)
Vulnerability from cvelistv5 – Published: 2023-01-12 00:00 – Updated: 2025-04-07 15:38
VLAI
EPSS
VEX
Title
Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot
Summary
An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to device due to out of resources. When a device is configured with "service-provider/SP style" switching, and mac-limiting is configured on an Aggregated Ethernet (ae) interface, and then a PFE is restarted or the device is rebooted, mac-limiting doesn't work anymore. Please note that the issue might not be apparent as traffic will continue to flow through the device although the mac table and respective logs will indicate that mac limit is reached. Functionality can be restored by removing and re-adding the MAC limit configuration. This issue affects Juniper Networks Junos OS on QFX5k Series, EX46xx Series: All versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3 on; 21.4 versions prior to 21.4R3 on; 22.1 versions prior to 22.1R2 on.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-07 15:00 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
- Denial of Service (DoS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.juniper.net/JSA70201 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Juniper Networks | Junos OS |
Affected:
unspecified , < 20.2R3-S5
(custom)
Affected: 20.3 , < 20.3R3-S5 (custom) Affected: 20.4 , < 20.4R3-S4 (custom) Affected: 21.1 , < 21.1R3-S3 (custom) Affected: 21.2 , < 21.2R3-S1 (custom) Affected: 21.3 , < 21.3R3 (custom) Affected: 21.4 , < 21.4R3 (custom) Affected: 22.1 , < 22.1R2 (custom) |
Date Public
2023-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:07:06.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://kb.juniper.net/JSA70201"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-07T15:00:37.278215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T15:38:23.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"QFX5k Series, EX46xx Series"
],
"product": "Junos OS",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "20.2R3-S5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "20.3R3-S5",
"status": "affected",
"version": "20.3",
"versionType": "custom"
},
{
"lessThan": "20.4R3-S4",
"status": "affected",
"version": "20.4",
"versionType": "custom"
},
{
"lessThan": "21.1R3-S3",
"status": "affected",
"version": "21.1",
"versionType": "custom"
},
{
"lessThan": "21.2R3-S1",
"status": "affected",
"version": "21.2",
"versionType": "custom"
},
{
"lessThan": "21.3R3",
"status": "affected",
"version": "21.3",
"versionType": "custom"
},
{
"lessThan": "21.4R3",
"status": "affected",
"version": "21.4",
"versionType": "custom"
},
{
"lessThan": "22.1R2",
"status": "affected",
"version": "22.1",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "To be vulnerable to this issue a \"service provider/SP\"-style configuration like the following needs to be present:\n\n [interfaces \u003cinterface\u003e ether-options 802.3ad ae\u003c#\u003e]\n [interfaces ae\u003c#\u003e unit \u003cunit\u003e vlan-id \u003cid\u003e]\n [switch-options interface ae\u003c#\u003e.\u003cid\u003e interface-mac-limit \u003climit\u003e]\n [switch-options interface ae\u003c#\u003e.\u003cid\u003e interface-mac-limit packet-action \u003caction\u003e]"
}
],
"datePublic": "2023-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to device due to out of resources. When a device is configured with \"service-provider/SP style\" switching, and mac-limiting is configured on an Aggregated Ethernet (ae) interface, and then a PFE is restarted or the device is rebooted, mac-limiting doesn\u0027t work anymore. Please note that the issue might not be apparent as traffic will continue to flow through the device although the mac table and respective logs will indicate that mac limit is reached. Functionality can be restored by removing and re-adding the MAC limit configuration. This issue affects Juniper Networks Junos OS on QFX5k Series, EX46xx Series: All versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3 on; 21.4 versions prior to 21.4R3 on; 22.1 versions prior to 22.1R2 on."
}
],
"exploits": [
{
"lang": "en",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"description": "Denial of Service (DoS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-12T00:00:00.000Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"url": "https://kb.juniper.net/JSA70201"
}
],
"solutions": [
{
"lang": "en",
"value": "The following software releases have been updated to resolve this specific issue: 20.2R3-S5, 20.3R3-S5, 20.4R3-S4, 21.1R3-S3, 21.2R3-S1, 21.3R3, 21.4R3, 22.1R2, 22.2R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA70201",
"defect": [
"1659873"
],
"discovery": "USER"
},
"title": "Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot",
"workarounds": [
{
"lang": "en",
"value": "There are no known workarounds for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2023-22405",
"datePublished": "2023-01-12T00:00:00.000Z",
"dateReserved": "2022-12-27T00:00:00.000Z",
"dateUpdated": "2025-04-07T15:38:23.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-22234 (GCVE-0-2022-22234)
Vulnerability from cvelistv5 – Published: 2022-10-18 02:46 – Updated: 2025-05-09 15:37
VLAI
EPSS
VEX
Title
Junos OS: EX2300 and EX3400 Series: One of more SFPs might become unavailable when the system is very busy
Summary
An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). If the device is very busy for example while executing a series of show commands on the CLI one or more SFPs might not be detected anymore. The system then changes its state to "unplugged" which is leading to traffic impact and at least a partial DoS. Once the system is less busy the port states return to their actual value. Indicators of compromise are log messages about unplugged SFPs and corresponding syspld messages without any physical or environmental cause. These can be checked by issuing the following commands: user@device# show log messages | match unplugged %PFE-6: fpc0 sfp-0/1/2 SFP unplugged %PFE-6: fpc0 sfp-0/1/3 SFP unplugged The following log messages will also be seen when this issue happens: fpc0 Error tvp_drv_syspld_read: syspld read failed for address <address> fpc0 Error[-1]:tvp_optics_presence_get - Syspld read failed for port <pic/port> fpc0 optics pres failed(-1) for pic <pic> port <port> fpc0 tvp_drv_syspld_read: i2c access retry count 200 This issue affects Juniper Networks Junos OS on EX2300 Series, EX3400 Series: All versions prior to 18.4R3-S11; 19.1 versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R2.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-09 15:37 UTC
CWE
- CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
- Denial of Service (DoS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kb.juniper.net/JSA69890 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Juniper Networks | Junos OS |
Affected:
unspecified , < 18.4R3-S11
(custom)
Affected: 19.1 , < 19.1R3-S9 (custom) Affected: 19.2 , < 19.2R1-S9, 19.2R3-S5 (custom) Affected: 19.3 , < 19.3R3-S6 (custom) Affected: 19.4 , < 19.4R2-S7, 19.4R3-S8 (custom) Affected: 20.1 , < 20.1R3-S4 (custom) Affected: 20.2 , < 20.2R3-S4 (custom) Affected: 20.3 , < 20.3R3-S4 (custom) Affected: 20.4 , < 20.4R3-S3 (custom) Affected: 21.1 , < 21.1R3-S1 (custom) Affected: 21.2 , < 21.2R3 (custom) Affected: 21.3 , < 21.3R2 (custom) Affected: 21.4 , < 21.4R2 (custom) |
Date Public
2022-10-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:07:49.798Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://kb.juniper.net/JSA69890"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-22234",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-09T15:37:47.222333Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T15:37:54.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"EX2300 Series, EX3400 Series"
],
"product": "Junos OS",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "18.4R3-S11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "19.1R3-S9",
"status": "affected",
"version": "19.1",
"versionType": "custom"
},
{
"lessThan": "19.2R1-S9, 19.2R3-S5",
"status": "affected",
"version": "19.2",
"versionType": "custom"
},
{
"lessThan": "19.3R3-S6",
"status": "affected",
"version": "19.3",
"versionType": "custom"
},
{
"lessThan": "19.4R2-S7, 19.4R3-S8",
"status": "affected",
"version": "19.4",
"versionType": "custom"
},
{
"lessThan": "20.1R3-S4",
"status": "affected",
"version": "20.1",
"versionType": "custom"
},
{
"lessThan": "20.2R3-S4",
"status": "affected",
"version": "20.2",
"versionType": "custom"
},
{
"lessThan": "20.3R3-S4",
"status": "affected",
"version": "20.3",
"versionType": "custom"
},
{
"lessThan": "20.4R3-S3",
"status": "affected",
"version": "20.4",
"versionType": "custom"
},
{
"lessThan": "21.1R3-S1",
"status": "affected",
"version": "21.1",
"versionType": "custom"
},
{
"lessThan": "21.2R3",
"status": "affected",
"version": "21.2",
"versionType": "custom"
},
{
"lessThan": "21.3R2",
"status": "affected",
"version": "21.3",
"versionType": "custom"
},
{
"lessThan": "21.4R2",
"status": "affected",
"version": "21.4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). If the device is very busy for example while executing a series of show commands on the CLI one or more SFPs might not be detected anymore. The system then changes its state to \"unplugged\" which is leading to traffic impact and at least a partial DoS. Once the system is less busy the port states return to their actual value. Indicators of compromise are log messages about unplugged SFPs and corresponding syspld messages without any physical or environmental cause. These can be checked by issuing the following commands: user@device# show log messages | match unplugged %PFE-6: fpc0 sfp-0/1/2 SFP unplugged %PFE-6: fpc0 sfp-0/1/3 SFP unplugged The following log messages will also be seen when this issue happens: fpc0 Error tvp_drv_syspld_read: syspld read failed for address \u003caddress\u003e fpc0 Error[-1]:tvp_optics_presence_get - Syspld read failed for port \u003cpic/port\u003e fpc0 optics pres failed(-1) for pic \u003cpic\u003e port \u003cport\u003e fpc0 tvp_drv_syspld_read: i2c access retry count 200 This issue affects Juniper Networks Junos OS on EX2300 Series, EX3400 Series: All versions prior to 18.4R3-S11; 19.1 versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R2."
}
],
"exploits": [
{
"lang": "en",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1250",
"description": "CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"description": "Denial of Service (DoS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00.000Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"url": "https://kb.juniper.net/JSA69890"
}
],
"solutions": [
{
"lang": "en",
"value": "The following software releases have been updated to resolve this specific issue: 18.4R3-S11, 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.3R3-S6, 19.4R2-S7, 19.4R3-S8, 20.1R3-S4, 20.2R3-S4, 20.3R3-S4, 20.4R3-S3, 21.1R3-S1, 21.2R3, 21.3R2, 21.4R2, 22.1R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69890",
"defect": [
"1602732"
],
"discovery": "USER"
},
"title": "Junos OS: EX2300 and EX3400 Series: One of more SFPs might become unavailable when the system is very busy",
"workarounds": [
{
"lang": "en",
"value": "There are no viable workarounds for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2022-22234",
"datePublished": "2022-10-18T02:46:36.121Z",
"dateReserved": "2021-12-21T00:00:00.000Z",
"dateUpdated": "2025-05-09T15:37:54.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-396V-898V-98HG
Vulnerability from github – Published: 2025-10-31 09:30 – Updated: 2026-03-27 09:31
VLAI
Details
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
Severity
7.4 (High)
{
"affected": [],
"aliases": [
"CVE-2025-30189"
],
"database_specific": {
"cwe_ids": [
"CWE-1250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-31T09:15:47Z",
"severity": "HIGH"
},
"details": "When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.",
"id": "GHSA-396v-898v-98hg",
"modified": "2026-03-27T09:31:17Z",
"published": "2025-10-31T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30189"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2025/oxdc-adv-2025-0001.json"
},
{
"type": "WEB",
"url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Oct/29"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/10/29/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7WHF-GJC8-HW23
Vulnerability from github – Published: 2025-12-05 06:31 – Updated: 2025-12-05 06:31
VLAI
Details
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-32899"
],
"database_specific": {
"cwe_ids": [
"CWE-1250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-05T05:16:59Z",
"severity": "MODERATE"
},
"details": "In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.",
"id": "GHSA-7whf-gjc8-hw23",
"modified": "2025-12-05T06:31:30Z",
"published": "2025-12-05T06:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32899"
},
{
"type": "WEB",
"url": "https://kde.org/info/security/advisory-20250418-1.txt"
},
{
"type": "WEB",
"url": "https://kdeconnect.kde.org"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9CV8-8VGQ-FG45
Vulnerability from github – Published: 2024-11-14 15:32 – Updated: 2025-11-04 00:32
VLAI
Details
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-10976"
],
"database_specific": {
"cwe_ids": [
"CWE-1250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-14T13:15:03Z",
"severity": "MODERATE"
},
"details": "Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application\u0027s pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.",
"id": "GHSA-9cv8-8vgq-fg45",
"modified": "2025-11-04T00:32:03Z",
"published": "2024-11-14T15:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10976"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250509-0010"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2024-10976"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.