CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2018-10241"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-16T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring.",
  "id": "GHSA-3x37-v82p-98jg",
  "modified": "2022-05-14T03:17:31Z",
  "published": "2022-05-14T03:17:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10241"
    },
    {
      "type": "WEB",
      "url": "https://www.bishopfox.com/news/2018/05/solarwinds-serv-u-managed-file-transfer-denial-of-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-38251"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-09T11:15:27Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: prevent NULL deref in clip_push()\n\nBlamed commit missed that vcc_destroy_socket() calls\nclip_push() with a NULL skb.\n\nIf clip_devs is NULL, clip_push() then crashes when reading\nskb-\u003etruesize.",
  "id": "GHSA-3x3g-jxm8-5fvx",
  "modified": "2025-12-18T18:30:28Z",
  "published": "2025-07-09T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38251"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c709dce16999bf6a1d2ce377deb5dd6fdd8cb08"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/41f6420ee845006354c004839fed07da71e34aee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/88c88f91f4b3563956bb52e7a71a3640f7ece157"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9199e8cb75f13a1650adcb3c6cad42789c43884e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a07005a77b18ae59b8471e7e4d991fa9f642b3c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b993ea46b3b601915ceaaf3c802adf11e7d6bac6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ede31ad949ae0d03cb4c5edd79991586ad7c8bb8"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-16T08:15:36Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Remove unused nvme_ls_waitq wait queue\n\nSystem crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up\ngets called for uninitialized wait queue sp-\u003envme_ls_waitq.\n\n    qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0\n    qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11\n    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n    PGD 0 P4D 0\n    Oops: 0000 [#1] SMP NOPTI\n    Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n    Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n    RIP: 0010:__wake_up_common+0x4c/0x190\n    RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n    RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n    RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n    RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n    R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n    R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n    FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    PKRU: 55555554\n    Call Trace:\n     __wake_up_common_lock+0x7c/0xc0\n     qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n     ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n     ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n     ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n\nRemove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed\npreviously in the commits tagged Fixed: below.",
  "id": "GHSA-3x66-jhf4-g79q",
  "modified": "2025-12-02T21:31:26Z",
  "published": "2025-09-16T15:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53280"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b1ce92fabdb7d02ddf8641230a06e2752ae5baa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/20fce500b232b970e40312a9c97e7f3b6d7a709c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/522ee1b3030f3b6b5fd59489d12b4ca767c9e5da"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/92529387a0066754fd9cda080fb3298b8cca750c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7084ebf4f54d46fed5153112d685f4137334175"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f459d586fdf12c53116c9fddf43065165fdd5969"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-02T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.",
  "id": "GHSA-3x6m-jc93-26vq",
  "modified": "2022-06-14T00:00:35Z",
  "published": "2022-06-03T00:01:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29694"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/issues/1588"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/pull/1593/commits/31389e59457f304be3809f9679f91a42daa7ebaa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/pull/1593/commits/6a879a082d4d67a5d13f1233ae0334cde0a7f844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/commit/3d3deac5e6d38602b689c4fef5dac004f07a2e63"
    },
    {
      "type": "WEB",
      "url": "https://violentbinary.github.io/posts/2-simple-analysis-of-software-virtualization-of-memory-in-unicorn-engine"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.74.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rclone/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T20:26:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## 1. Summary\n\nA transport failure during the initial Infinite Scale TUS creation POST can return `(nil response, non-nil error)`. Rclone dereferences the nil response before processing the error and panics. The production `CreateUploader` path reproduced the crash against a closed endpoint.\n\nThe security case is deployment-dependent. A one-shot upload already fails when its endpoint resets, while RC jobs recover panics in `fs/rc/jobs/job.go` and return a job error. The incremental denial of service is strongest in a long-lived VFS mount or concurrent/multi-remote CLI process where the upload runs in an unrecovered goroutine and the panic terminates unrelated work.\n\n## 2. Affected Assets \u0026 Attack Surface\n\n- Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`)\n- Current-master check: `backend/webdav/tus.go` was unchanged at master commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18\n- Response evaluation: `backend/webdav/tus.go:45-59`\n- Creation path: `backend/webdav/tus.go:61-107`\n- Unrecovered VFS caller: `vfs/write.go:71-81`\n- Contained RC caller: `fs/rc/jobs/job.go:107-115`\n- Configuration: Infinite Scale WebDAV uploads using TUS\n- Code triggers: any pre-response transport failure, including refusal, reset, timeout, DNS/TLS/proxy failure, or cancellation\n- Security trigger: a malicious/compromised configured endpoint resets an upload in a long-lived or multi-workload process\n\n## 3. Technical Root Cause Analysis\n\n`getTusLocationOrRetry` switches on `resp.StatusCode` before checking whether `resp` is nil or handling the accompanying error. A nil response is valid when the HTTP transaction fails before a response is parsed. There is no recovery boundary in the WebDAV operation itself. Whether the panic is process-fatal depends on its caller: the VFS write path starts `operations.Rcat` in an unrecovered goroutine (`vfs/write.go:71-81`), whereas RC jobs wrap their function in `recover` (`fs/rc/jobs/job.go:107-115`).\n\n## 4. Proof-of-Concept \u0026 Evidence\n\n1. Configure the actual Infinite Scale creation path to a closed local endpoint.\n2. Invoke `Object.CreateUploader`.\n3. The POST returns a transport error and no response.\n4. `getTusLocationOrRetry` dereferences `resp.StatusCode` and panics.\n\nA remote endpoint can produce the same `(nil response, non-nil error)` state by accepting and resetting the connection before returning an HTTP response. TLS prevents arbitrary response modification but does not prevent the configured endpoint from closing or resetting its own connection. Refusal, DNS, TLS, proxy, and cancellation failures exercise the code defect but do not by themselves identify a remote security actor.\n\n## 5. Impact Assessment\n\nIn an unrecovered CLI or VFS upload goroutine, the panic terminates the rclone process and any unrelated work it hosts. A hostile configured endpoint can repeat the condition whenever the victim initiates a TUS upload. RC jobs are excluded from the process-wide impact because their execution boundary recovers the panic and records an error. In a one-shot process dedicated to the hostile endpoint, the incremental security impact over an ordinary transport error is limited.\n\n## 6. Remediation Guidance\n\n- Check `resp == nil` before accessing response fields.\n- Pass transport errors through the existing retry policy and return a normal error after exhaustion.\n- Test refusal, reset, timeout, DNS, TLS, proxy, and cancellation paths.\n- Add panic containment to long-lived worker goroutines as defense in depth; keep nil handling as the primary fix.",
  "id": "GHSA-3x6r-wxxg-53vv",
  "modified": "2026-08-05T20:26:07Z",
  "published": "2026-08-05T20:26:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/5871d98c368751a6d992ed64f8cd22cb78c44cee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rclone/rclone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-47753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T13:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix VP8 stateless decoder smatch warning\n\nFix a smatch static checker warning on vdec_vp8_req_if.c.\nWhich leads to a kernel crash when fb is NULL.",
  "id": "GHSA-3x9w-fg96-5j98",
  "modified": "2025-11-03T21:31:22Z",
  "published": "2024-10-21T15:32:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47753"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3167aa42941b68405a092df114453ef0f1b09c2c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35cc704622b3a9bc02a4755d5ba80238eee3cdc2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e0713c79cf5d0b549fa855e230ade1ff83c27d7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b113bc7c0e83b32f4dd2d291a2b6c4803e0a2c44"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dbe5b7373801c261f3ea118145fbb2caac5f9324"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-47610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T15:15:55Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix null ptr access msm_ioctl_gem_submit()\n\nFix the below null pointer dereference in msm_ioctl_gem_submit():\n\n 26545.260705:   Call trace:\n 26545.263223:    kref_put+0x1c/0x60\n 26545.266452:    msm_ioctl_gem_submit+0x254/0x744\n 26545.270937:    drm_ioctl_kernel+0xa8/0x124\n 26545.274976:    drm_ioctl+0x21c/0x33c\n 26545.278478:    drm_compat_ioctl+0xdc/0xf0\n 26545.282428:    __arm64_compat_sys_ioctl+0xc8/0x100\n 26545.287169:    el0_svc_common+0xf8/0x250\n 26545.291025:    do_el0_svc_compat+0x28/0x54\n 26545.295066:    el0_svc_compat+0x10/0x1c\n 26545.298838:    el0_sync_compat_handler+0xa8/0xcc\n 26545.303403:    el0_sync_compat+0x188/0x1c0\n 26545.307445:   Code: d503201f d503201f 52800028 4b0803e8 (b8680008)\n 26545.318799:   Kernel panic - not syncing: Oops: Fatal exception",
  "id": "GHSA-3xcp-65mf-qfv3",
  "modified": "2024-08-27T18:31:35Z",
  "published": "2024-06-19T15:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47610"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26d776fd0f79f093a5d0ce1a4c7c7a992bc3264c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6db3d98f876870c35e96693cfd54752f6199e59"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-48857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T19:15:31Z",
    "severity": "HIGH"
  },
  "details": "NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.",
  "id": "GHSA-3xg4-9379-gq7p",
  "modified": "2025-01-14T21:31:47Z",
  "published": "2025-01-14T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48857"
    },
    {
      "type": "WEB",
      "url": "https://support.blackberry.com/pkb/s/article/140334"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:51Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix handling of virtual Fibre Channel timeouts\n\nHyper-V provides the ability to connect Fibre Channel LUNs to the host\nsystem and present them in a guest VM as a SCSI device. I/O to the vFC\ndevice is handled by the storvsc driver. The storvsc driver includes a\npartial integration with the FC transport implemented in the generic\nportion of the Linux SCSI subsystem so that FC attributes can be displayed\nin /sys.  However, the partial integration means that some aspects of vFC\ndon\u0027t work properly. Unfortunately, a full and correct integration isn\u0027t\npractical because of limitations in what Hyper-V provides to the guest.\n\nIn particular, in the context of Hyper-V storvsc, the FC transport timeout\nfunction fc_eh_timed_out() causes a kernel panic because it can\u0027t find the\nrport and dereferences a NULL pointer. The original patch that added the\ncall from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this\nregard.\n\nIn many cases a timeout is due to a transient condition, so the situation\ncan be improved by just continuing to wait like with other I/O requests\nissued by storvsc, and avoiding the guaranteed panic. For a permanent\nfailure, continuing to wait may result in a hung thread instead of a panic,\nwhich again may be better.\n\nSo fix the panic by removing the storvsc call to fc_eh_timed_out().  This\nallows storvsc to keep waiting for a response.  The change has been tested\nby users who experienced a panic in fc_eh_timed_out() due to transient\ntimeouts, and it solves their problem.\n\nIn the future we may want to deprecate the vFC functionality in storvsc\nsince it can\u0027t be fully fixed. But it has current users for whom it is\nworking well enough, so it should probably stay for a while longer.",
  "id": "GHSA-3xmr-hc67-565w",
  "modified": "2025-12-03T21:31:00Z",
  "published": "2025-09-15T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53245"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/048ebc9a28fb918ee635dd4b2fcf4248eb6e4050"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1678408d08f31a694d5150a56796dd04c9710b22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/175544ad48cbf56affeef2a679c6a4d4fb1e2881"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/311db605e07f0d4fc0cc7ddb74f1e5692ea2f469"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/763c06565055ae373fe7f89c11e1447bd1ded264"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a792b3d888aab2c65389f9f4f9f2f6c000b1a0d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd87f4df9865a53807001ed12c0f0420b14ececd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed70fa5629a8b992a5372d7044d1db1f8fa6de29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-47003"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-16T05:15:29Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.",
  "id": "GHSA-3xmr-xg4j-24rr",
  "modified": "2023-11-21T03:30:25Z",
  "published": "2023-11-16T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47003"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RedisGraph/RedisGraph/issues/3063"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}