CWE-664
DiscouragedImproper Control of a Resource Through its Lifetime
Abstraction: Pillar · Status: Draft
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
75 vulnerabilities reference this CWE, most recent first.
GHSA-494P-Q444-9XF7
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-07-02 12:30In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false.
The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to ' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes.
Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change.
The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker.
The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently.
The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
{
"affected": [],
"aliases": [
"CVE-2026-43503"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-23T12:17:02Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination. __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched. As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data(). ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0027dup to \u003clocal\u003e\u0027 rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0027d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source. skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0027s frag descriptors into the\naccumulator\u0027s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0027s frag_list. Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb\u0027s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb. The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0027s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0027s flag into nskb. Fold frag_skb\u0027s flag at both sites\nso segments drawing frags from frag_list members carry the marker.",
"id": "GHSA-494p-q444-9xf7",
"modified": "2026-07-02T12:30:48Z",
"published": "2026-05-26T13:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43503"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23240"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23245"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23468"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23469"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23470"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23471"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24814"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25044"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33486"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-43503"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480902"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19521"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19540"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19569"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19664"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19666"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19705"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19711"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19875"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20051"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20129"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20130"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20299"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20593"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21656"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21695"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21702"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-554F-G6VM-MG6X
Vulnerability from github – Published: 2024-06-26 06:30 – Updated: 2024-06-26 06:30Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to temporary resource constraint of system application. Exploitation may lead to denial of service of the application.
{
"affected": [],
"aliases": [
"CVE-2024-37139"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-26T04:15:13Z",
"severity": "MODERATE"
},
"details": "Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to temporary resource constraint of system application. Exploitation may lead to denial of service of the application.",
"id": "GHSA-554f-g6vm-mg6x",
"modified": "2024-06-26T06:30:29Z",
"published": "2024-06-26T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37139"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-583G-G682-CRXF
Vulnerability from github – Published: 2024-02-09 15:19 – Updated: 2024-02-09 15:19Summary
Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought.
Details
A malicious/compromised website can make HTTP requests to localhost. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered.
Impact
Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http-server-netty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http-server-tck"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-23639"
],
"database_specific": {
"cwe_ids": [
"CWE-15",
"CWE-610",
"CWE-664"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-09T15:19:15Z",
"nvd_published_at": "2024-02-09T01:15:09Z",
"severity": "MODERATE"
},
"details": "### Summary\nEnabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought.\n\n### Details\nA malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are [\"simple\"](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered.\n\n### Impact\nProduction environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.\n",
"id": "GHSA-583g-g682-crxf",
"modified": "2024-02-09T15:19:15Z",
"published": "2024-02-09T15:19:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-583g-g682-crxf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23639"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/pull/8642"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/commit/01adb21e57137caaf7004313d2055c5a78b1f47b"
},
{
"type": "WEB",
"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests"
},
{
"type": "PACKAGE",
"url": "https://github.com/micronaut-projects/micronaut-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Micronaut management endpoints vulnerable to drive-by localhost attack"
}
GHSA-66WP-PMR8-89FQ
Vulnerability from github – Published: 2024-09-12 21:32 – Updated: 2024-09-12 21:32A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-45383"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-12T19:15:04Z",
"severity": "MODERATE"
},
"details": "A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability.",
"id": "GHSA-66wp-pmr8-89fq",
"modified": "2024-09-12T21:32:02Z",
"published": "2024-09-12T21:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45383"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-694Q-9G62-WGQW
Vulnerability from github – Published: 2025-08-06 03:30 – Updated: 2025-08-06 03:30Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability.
{
"affected": [],
"aliases": [
"CVE-2025-54613"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T02:15:47Z",
"severity": "MODERATE"
},
"details": "Iterator failure vulnerability in the card management module.\nImpact: Successful exploitation of this vulnerability may affect function stability.",
"id": "GHSA-694q-9g62-wgqw",
"modified": "2025-08-06T03:30:24Z",
"published": "2025-08-06T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54613"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2025/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6W53-H492-P28F
Vulnerability from github – Published: 2026-05-14 21:30 – Updated: 2026-05-15 00:30Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-8582"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T20:17:20Z",
"severity": "MODERATE"
},
"details": "Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-6w53-h492-p28f",
"modified": "2026-05-15T00:30:30Z",
"published": "2026-05-14T21:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8582"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/497594413"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7868-9J9H-FR97
Vulnerability from github – Published: 2022-05-17 02:51 – Updated: 2022-05-17 02:51The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an improper resource release vulnerability, which allows attackers to cause a system restart or privilege elevation.
{
"affected": [],
"aliases": [
"CVE-2016-8763"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-02T20:59:00Z",
"severity": "HIGH"
},
"details": "The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an improper resource release vulnerability, which allows attackers to cause a system restart or privilege elevation.",
"id": "GHSA-7868-9j9h-fr97",
"modified": "2022-05-17T02:51:04Z",
"published": "2022-05-17T02:51:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8763"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-01-smartphone-en"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94509"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PGF-PPXW-8624
Vulnerability from github – Published: 2025-07-12 18:30 – Updated: 2025-11-05 20:30The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.
This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.zeppelin:zeppelin-interpreter"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "0.12.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.zeppelin:zeppelin-server"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "0.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41169"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-14T20:31:20Z",
"nvd_published_at": "2025-07-12T17:15:20Z",
"severity": "HIGH"
},
"details": "The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server\u0027s resources, including directories and files.\n\nThis issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0,\u00a0which fixes the issue by removing the Cluster Interpreter.",
"id": "GHSA-7pgf-ppxw-8624",
"modified": "2025-11-05T20:30:41Z",
"published": "2025-07-12T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41169"
},
{
"type": "WEB",
"url": "https://github.com/apache/zeppelin/pull/4841"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/zeppelin"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/ZEPPELIN-6101"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/07/13/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Zeppelin exposes server resources to unauthenticated attackers"
}
GHSA-8MJR-JR5H-Q2XR
Vulnerability from github – Published: 2022-07-15 18:17 – Updated: 2024-11-22 18:11Impact
This vulnerability affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected.
This faulty behavior is not observed in StarkNet's testing framework, so don't rely on it passing to detect this issue on custom accounts.
Patches
This bug has been patched in v0.2.1.
References
The issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386.
For more information
If you have any questions or comments about this advisory: * Open an issue in the Contracts for Cairo repo * Email us at security@openzeppelin.com
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "openzeppelin-cairo-contracts"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31153"
],
"database_specific": {
"cwe_ids": [
"CWE-664",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-15T18:17:19Z",
"nvd_published_at": "2022-07-15T18:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nThis vulnerability affects all accounts (vanilla and ethereum flavors) in the [v0.2.0 release of OpenZeppelin Contracts for Cairo](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.0), which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected.\n\nThis faulty behavior is not observed in [StarkNet\u0027s testing framework](https://github.com/starkware-libs/cairo-lang/blob/master/src/starkware/starknet/testing/starknet.py), so don\u0027t rely on it passing to detect this issue on custom accounts.\n\n### Patches\nThis bug has been patched in [v0.2.1](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1).\n\n### References\nThe issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Contracts for Cairo repo](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose)\n* Email us at [security@openzeppelin.com](mailto:security@openzeppelin.com)\n",
"id": "GHSA-8mjr-jr5h-q2xr",
"modified": "2024-11-22T18:11:28Z",
"published": "2022-07-15T18:17:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31153"
},
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/issues/386"
},
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/pull/387"
},
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenZeppelin/cairo-contracts"
},
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203"
},
{
"type": "WEB",
"url": "https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/openzeppelin-cairo-contracts-test/PYSEC-2022-43143.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli"
}
GHSA-8VQ8-5XVJ-8HQC
Vulnerability from github – Published: 2025-08-06 03:30 – Updated: 2025-08-06 03:30Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availability.
{
"affected": [],
"aliases": [
"CVE-2025-54619"
],
"database_specific": {
"cwe_ids": [
"CWE-664"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T02:15:48Z",
"severity": "MODERATE"
},
"details": "Iterator failure issue in the multi-mode input module.\nImpact: Successful exploitation of this vulnerability may cause iterator failures and affect availability.",
"id": "GHSA-8vq8-5xvj-8hqc",
"modified": "2025-08-06T03:30:25Z",
"published": "2025-08-06T03:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54619"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2025/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-196: Session Credential Falsification through Forging
An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs from Reuse of Session IDs and Session Sidejacking attacks in that in the latter attacks an attacker uses a previous or existing credential without modification while, in a forging attack, the attacker must create their own credential, although it may be based on previously observed credentials.
CAPEC-21: Exploitation of Trusted Identifiers
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-61: Session Fixation
The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.