CWE-248

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.2.3"
            },
            {
              "fixed": "12.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.2.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36046"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-30T20:38:34Z",
    "nvd_published_at": "2022-08-31T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nWhen specific requests are made to the Next.js server it can cause an `unhandledRejection` in the server which can crash the process to exit in specific Node.js versions with strict `unhandledRejection` handling. \n\n- Affected: All of the following must be true to be affected by this CVE\n  - Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting\n  - Next.js version v12.2.3\n  - Using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server)\n \n- Not affected: Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn\u0027t being shared across requests.\n\n### Patches\nhttps://github.com/vercel/next.js/releases/tag/v12.2.4\n",
  "id": "GHSA-wff4-fpwg-qqv3",
  "modified": "2022-09-08T14:17:38Z",
  "published": "2022-08-30T20:38:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36046"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/releases/tag/v12.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unexpected server crash in Next.js"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "phonenumber"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "phonenumber"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0"
            },
            {
              "fixed": "0.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-42444"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284",
      "CWE-248",
      "CWE-392"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-21T17:10:57Z",
    "nvd_published_at": "2023-09-19T15:15:56Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.\n\nIn a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.\n\n### Patches\nPatches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.\n\n### Workarounds\nn.a.\n\n### References\nn.a.",
  "id": "GHSA-whhr-7f2w-qqj2",
  "modified": "2026-03-11T20:35:22Z",
  "published": "2023-09-21T17:10:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42444"
    },
    {
      "type": "WEB",
      "url": "https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/whisperfish/rust-phonenumber"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2023-0082.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phonenumber panics on parsing crafted RFC3966 inputs"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:04:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "A single unauthenticated WebSocket message to `/rpc` crashed the SurrealDB server. Sending `use { db: \"x\" }` without first selecting a namespace hit `.expect(\"namespace should be set\")` in the `use` handler; because `surrealdb-core` is built with `panic = \u0027abort\u0027`, the panic terminated the process. `use` is callable before `signin`, and the per-method capability check passes by default for guest callers \u2014 so no credentials, token, or `--allow-guests` flag are required.\n\n### Impact\n\nAn unauthenticated remote attacker who could reach the `/rpc` endpoint could crash the SurrealDB server with a single WebSocket message. No credentials, token, session knowledge, or capability are required.\n\n### Patches\n\nA patch has been introduced that returns a typed `invalid_params` response when `db` is set on a session with no `ns`, replacing the panic.\n\n- Versions 3.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update should restrict network access to the `/rpc` endpoint to trusted clients, and run SurrealDB under a process supervisor that restarts on crash.",
  "id": "GHSA-wjjj-24cx-f28g",
  "modified": "2026-07-01T20:04:22Z",
  "published": "2026-07-01T20:04:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wjjj-24cx-f28g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/commit/1537ec4fbd789c61a5b43b648a854577dbe31a34"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/surrealdb/surrealdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SurrealDB has unauthenticated remote DoS via malformed RPC `use` call"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dicer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.webjars.npm:dicer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-25T20:22:41Z",
    "nvd_published_at": "2022-05-20T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects all versions of the package `dicer`. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop.",
  "id": "GHSA-wm7h-9275-46v2",
  "modified": "2023-08-28T14:22:54Z",
  "published": "2022-05-21T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24434"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mscdex/busboy/issues/250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mscdex/dicer/pull/22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mscdex/dicer/commit/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mscdex/dicer"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-DICER-2311764"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Crash in HeaderParser in dicer"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/obi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:56:06Z",
    "nvd_published_at": "2026-06-02T16:16:42Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nOBI\u0027s replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointers or slice past string tables, causing the agent to panic while determining the process language.\n\n### Details\n\n`matchExeSymbols `iterates over sections and uses offsets/symbol names from the unvalidated `fastelf `context; nil section pointers or out-of-range offsets can trigger panics during dereference/slicing.\n\nhttps://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/cec36c1b872beba9d17956bfde75dee3249a1516/pkg/internal/exec/proclang_linux.go#L133-L165\n\n`GetCStringUnsafe` and `ReadStruct` perform unsafe slicing and pointer conversion without guarding against out-of-range or negative offsets derived from ELF data, enabling panics on malformed input.\n\nhttps://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/cec36c1b872beba9d17956bfde75dee3249a1516/pkg/internal/fastelf/fastelf.go#L201-L213\n\n`NewElfContextFromData `trusts `Shoff`/`Shnum`/`Phnum `from the ELF header, converting them to `int `and populating sections/segments without validating offsets or ensuring `ReadStruct `returned non-nil.\n\nhttps://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/cec36c1b872beba9d17956bfde75dee3249a1516/pkg/internal/fastelf/fastelf.go#L271-L296\n\nMalformed ELF metadata can therefore crash OBI during normal process discovery.\n\n### PoC\n\nLocal testing confirms the parser panic path on the vulnerable release, but one caveat is worth noting: rerunning a previously captured malformed-ELF PoC directly against the current checkout did not reproduce the original crash. That means the parser has drifted since the vulnerable release, so reproduction should be performed against the affected release tag or commit range rather than assuming current `HEAD` still panics in exactly the same way.\n\nUse a vulnerable build:\n\n```bash\ngit checkout v0.0.0-rc.1+build\nmake build\n```\n\nCreate a small valid ELF and then corrupt its section-header metadata:\n\n```bash\ncat \u003e/tmp/hello.c \u003c\u003c\u0027EOF\u0027\nint main(void) { return 0; }\nEOF\ncc -o /tmp/hello /tmp/hello.c\ncp /tmp/hello /tmp/hello-bad\nprintf \u0027\\xff\\xff\u0027 | dd of=/tmp/hello-bad bs=1 seek=$((0x3c)) conv=notrunc\n```\n\nRun the malformed executable so OBI inspects it during process discovery:\n\n```bash\nchmod +x /tmp/hello-bad\n/tmp/hello-bad \u0026\n```\n\nStart OBI or trigger a rescan of processes:\n\n```bash\nsudo ./bin/obi\n```\n\nOn a vulnerable build, OBI can panic while parsing the malformed ELF. If the first corruption does not hit the exact fragile path on your architecture, alter section-name or symbol-table offsets instead; the root issue is the lack of defensive validation before `GetCStringUnsafe` and related section lookups.\n\n### Impact\n\nThis is a local denial of service against the telemetry agent. Any local tenant or process owner able to execute a malformed binary on a monitored host can crash OBI and interrupt observability for other workloads.",
  "id": "GHSA-wp73-mwgf-4jq9",
  "modified": "2026-06-09T10:57:54Z",
  "published": "2026-05-18T17:56:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45676"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.69.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@sveltejs/kit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.69.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T15:50:40Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.",
  "id": "GHSA-wqjv-9729-c5q2",
  "modified": "2026-07-24T15:50:40Z",
  "published": "2026-07-24T15:50:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-wqjv-9729-c5q2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/pull/16219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/commit/82b0370c793ac392cee5c2e28f4b8fed09c64582"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sveltejs/kit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SvelteKit: Big remote form function payloads can cause Node process to crash"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T12:16:24Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled \"std::invalid_argument\" exception, ultimately causing the program to terminate.",
  "id": "GHSA-wv7r-xg3p-ccr7",
  "modified": "2026-04-27T12:30:38Z",
  "published": "2026-04-27T12:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5937"
    },
    {
      "type": "WEB",
      "url": "https://www.foxit.com/support/security-bulletins.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.7.4"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "deno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T18:48:18Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA Deno program that opens a client `WebSocket` connection could be crashed by\nthe remote server. While handling the WebSocket handshake response, Deno parsed\nthe `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in\na way that assumed their bytes were always printable ASCII. A response header\ncontaining non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that aborted\nthe entire Deno process.\n\n## Details\n\nWhen establishing a client WebSocket connection, Deno read the\n`Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers from the\nserver\u0027s `101 Switching Protocols` response and converted them to strings\nwithout handling the failure case. `HeaderValue::to_str()` returns an error for\nany value containing bytes outside the visible-ASCII range, so a header carrying\nsuch bytes triggered an unrecoverable error during conversion.\n\nBecause the client initiates the outbound connection, the handshake response is\nfully controlled by the server. A server that returns bytes such as `0xFF 0xFE`\nin either header could therefore crash any client that connected to it.\n\nThis is purely an availability issue. There is no information disclosure and no\nmemory-safety impact; the only effect is termination of the current process.\n\n## Impact\n\nRemote denial of service. Any Deno application that establishes WebSocket\nconnections to untrusted or potentially-compromised endpoints could be\nterminated by the remote peer. Exploitation requires the victim application to\ninitiate the outbound WebSocket connection. An attacker who controls the\nWebSocket endpoint, or who can man-in-the-middle a plaintext `ws://` connection,\ncould trigger the crash. The effect is confined to crashing the process that\nopened the connection.\n\n## Patch\n\nThe issue is fixed in Deno `2.7.5`. The header values are now parsed with\ngraceful fallbacks: values that cannot be represented as ASCII strings are\nskipped instead of aborting the process. A regression test covers a server that\nreturns non-ASCII bytes in `Sec-WebSocket-Protocol`.\n\nUsers should upgrade to Deno `2.7.5` or later.\n\n## Workarounds\n\nUntil you can upgrade, only connect to trusted WebSocket endpoints and prefer\n`wss://` (TLS) over `ws://`, which prevents a network man-in-the-middle from\ninjecting malicious header bytes into the handshake response.",
  "id": "GHSA-x2qc-cmh9-f4hf",
  "modified": "2026-06-17T18:48:18Z",
  "published": "2026-06-17T18:48:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/denoland/deno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deno: Denial of service via non-ASCII bytes in WebSocket response headers"
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-10363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-404"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-16T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.",
  "id": "GHSA-x36p-26r2-96m6",
  "modified": "2022-05-13T01:38:50Z",
  "published": "2022-05-13T01:38:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10363"
    },
    {
      "type": "WEB",
      "url": "https://www.elastic.co/community/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-71391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-18T14:17:10Z",
    "severity": "HIGH"
  },
  "details": "SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.",
  "id": "GHSA-x3fg-mm84-q54h",
  "modified": "2026-08-13T15:34:13Z",
  "published": "2026-07-18T15:31:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71391"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}