CWE-193
AllowedOff-by-one Error
Abstraction: Base · Status: Draft
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
278 vulnerabilities reference this CWE, most recent first.
GHSA-CX6H-86XW-9X34
Vulnerability from github – Published: 2023-07-06 21:14 – Updated: 2024-04-24 19:16The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M2"
},
{
"fixed": "11.0.0-M5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.5"
},
{
"fixed": "10.1.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.71"
},
{
"fixed": "9.0.74"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.85"
},
{
"fixed": "8.5.88"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28709"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T23:34:50Z",
"nvd_published_at": "2023-05-22T11:15:09Z",
"severity": "HIGH"
},
"details": "The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.",
"id": "GHSA-cx6h-86xw-9x34",
"modified": "2024-04-24T19:16:49Z",
"published": "2023-07-06T21:14:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28709"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/5badf94e79e5de206fc0ef3054fd536b1bb787cd"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dc"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-37"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230616-0004"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5521"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/22/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Tomcat - Fix for CVE-2023-24998 was incomplete"
}
GHSA-CX83-C67H-H9GR
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
{
"affected": [],
"aliases": [
"CVE-2018-14682"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-28T23:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.",
"id": "GHSA-cx83-c67h-h9gr",
"modified": "2022-05-13T01:10:32Z",
"published": "2022-05-13T01:10:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14682"
},
{
"type": "WEB",
"url": "https://github.com/kyz/libmspack/commit/4fd9ccaa54e1aebde1e4b95fb0163b699fd7bcc8"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3327"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3505"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/904800"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201903-20"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3728-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3728-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3728-3"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3789-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4260"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2018/07/26/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F38W-MWF7-VV8P
Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-06-30 15:30In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.
{
"affected": [],
"aliases": [
"CVE-2026-58374"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T13:19:18Z",
"severity": "MODERATE"
},
"details": "In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.",
"id": "GHSA-f38w-mwf7-vv8p",
"modified": "2026-06-30T15:30:45Z",
"published": "2026-06-30T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58374"
},
{
"type": "WEB",
"url": "https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187"
},
{
"type": "WEB",
"url": "https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193"
},
{
"type": "WEB",
"url": "https://w1.fi/security/2026-1"
},
{
"type": "WEB",
"url": "https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/06/30/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCHC-223X-3CPC
Vulnerability from github – Published: 2022-12-23 00:30 – Updated: 2022-12-28 21:30A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-36354"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T22:15:00Z",
"severity": "MODERATE"
},
"details": "A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability.",
"id": "GHSA-fchc-223x-3cpc",
"modified": "2022-12-28T21:30:21Z",
"published": "2022-12-23T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36354"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-33"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1629"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5384"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FH2C-3J7R-HVGV
Vulnerability from github – Published: 2025-04-14 21:32 – Updated: 2025-04-14 21:32In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds access.
{
"affected": [],
"aliases": [
"CVE-2022-49365"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()\n\nThe \u003e ARRAY_SIZE() should be \u003e= ARRAY_SIZE() to prevent an out of bounds\naccess.",
"id": "GHSA-fh2c-3j7r-hvgv",
"modified": "2025-04-14T21:32:22Z",
"published": "2025-04-14T21:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49365"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/607c5cd1a08e196d9f2bd3b25a8083ed27ad7ceb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a35faec3db0e13aac8ea720bc1a3503081dd5a3d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b0808b7a04157b3f56e919f27023fec37a075fad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec9ec3bc08b18c5b1b2feafd306ea7c348013898"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHCF-VPM9-JPHV
Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2022-05-24 16:44An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
{
"affected": [],
"aliases": [
"CVE-2019-10131"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-30T19:29:00Z",
"severity": "HIGH"
},
"details": "An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.",
"id": "GHSA-fhcf-vpm9-jphv",
"modified": "2022-05-24T16:44:54Z",
"published": "2022-05-24T16:44:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10131"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551b94a794864861592e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10131"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4034-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00051.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00001.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108117"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FJ2P-R342-GX3M
Vulnerability from github – Published: 2022-05-02 00:05 – Updated: 2022-05-02 00:05Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
{
"affected": [],
"aliases": [
"CVE-2008-3964"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-09-11T01:13:00Z",
"severity": "MODERATE"
},
"details": "Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.",
"id": "GHSA-fj2p-r342-gx3m",
"modified": "2022-05-02T00:05:25Z",
"published": "2022-05-02T00:05:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3964"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44928"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31781"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33137"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35302"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35386"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200812-15.xml"
},
{
"type": "WEB",
"url": "http://sourceforge.net/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com\u0026forum_name=png-mng-implement"
},
{
"type": "WEB",
"url": "http://sourceforge.net/project/shownotes.php?group_id=5624\u0026release_id=624517"
},
{
"type": "WEB",
"url": "http://sourceforge.net/project/shownotes.php?release_id=624518"
},
{
"type": "WEB",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=2095669\u0026group_id=5624\u0026atid=105624"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1"
},
{
"type": "WEB",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/889484"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:051"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/09/09/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/09/09/8"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31049"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2512"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1462"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1560"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FPPM-3X24-27Q8
Vulnerability from github – Published: 2022-04-30 18:16 – Updated: 2024-02-15 21:31Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog function.
{
"affected": [],
"aliases": [
"CVE-2001-0609"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2001-08-02T04:00:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog function.",
"id": "GHSA-fppm-3x24-27q8",
"modified": "2024-02-15T21:31:21Z",
"published": "2022-04-30T18:16:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-0609"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6364"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0202.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/2576"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FQ9X-8G2W-4P5R
Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-07-08 06:31In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix off-by-one in multicast context address compression
The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively.
This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents
The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID)
Also zero-initialize the data array as a defensive measure against similar bugs in the future.
{
"affected": [],
"aliases": [
"CVE-2026-53263"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T09:16:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix off-by-one in multicast context address compression\n\nThe second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses\n\u0026data[1] as destination and \u0026ipaddr-\u003es6_addr[11] as source, but\nboth should be offset by one: \u0026data[2] and \u0026ipaddr-\u003es6_addr[12]\nrespectively.\n\nThis off-by-one has two consequences:\n1. data[1] is overwritten with s6_addr[11], corrupting the RIID\n field in the compressed multicast address\n2. data[5] is never written, so uninitialized kernel stack memory\n is transmitted over the network via lowpan_push_hc_data(),\n leaking kernel stack contents\n\nThe correct inline data layout must match what the decompression\nfunction lowpan_uncompress_multicast_ctx_daddr() expects:\n data[0..1] = s6_addr[1..2] (flags/scope + RIID)\n data[2..5] = s6_addr[12..15] (group ID)\n\nAlso zero-initialize the data array as a defensive measure against\nsimilar bugs in the future.",
"id": "GHSA-fq9x-8g2w-4p5r",
"modified": "2026-07-08T06:31:34Z",
"published": "2026-06-25T09:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53263"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G8QJ-VP23-742M
Vulnerability from github – Published: 2026-08-26 00:30 – Updated: 2026-08-26 18:31Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
{
"affected": [],
"aliases": [
"CVE-2026-65927"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T22:17:05Z",
"severity": "HIGH"
},
"details": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.",
"id": "GHSA-g8qj-vp23-742m",
"modified": "2026-08-26T18:31:49Z",
"published": "2026-08-26T00:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65927"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/26/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
No CAPEC attack patterns related to this CWE.