CWE-670

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/btcsuite/btcd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.2-beta.rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-38365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-10T16:43:17Z",
    "nvd_published_at": "2024-10-11T20:15:04Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality. This\nlogic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). \n\nThis consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn\u0027t return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a \"standard\" Bitcoin\ntransaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block.\n\n#### `FindAndDelete` vs. `removeOpcodeByData`\n\n`removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that *contain* `dataToRemove`. However, `FindAndDelete` only removes *exact* matches. So for example, with `script = \"\u003cdata\u003e \u003cdata||foo\u003e\"` and `dataToRemove = \"data\"` btcd will remove both data pushes but Bitcoin Core\u0027s `FindAndDelete` only removes the first `\u003cdata\u003e` push.\n\n\n### Patches\n\nThis has been patched in `btcd` version v0.24.2-beta. \n\n### References\n\n`FindAndDelete`: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8",
  "id": "GHSA-27vh-h6mc-q6g8",
  "modified": "2025-08-21T04:05:13Z",
  "published": "2024-10-10T16:43:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38365"
    },
    {
      "type": "WEB",
      "url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
    },
    {
      "type": "WEB",
      "url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/btcsuite/btcd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "btcd did not correctly re-implement Bitcoin Core\u0027s \"FindAndDelete()\" functionality"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.134.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ydb-platform/ydb-go-sdk/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.104.6"
            },
            {
              "fixed": "3.134.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-30T18:21:04Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nTransactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.\n\n### Patches\n`ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).\n\n### Workarounds\n1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`.\n2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session.\n3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda`\n\n### Resources\nCommit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9\nCommit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d",
  "id": "GHSA-28xx-pppm-vqff",
  "modified": "2026-06-08T20:10:28Z",
  "published": "2026-04-30T18:21:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/pull/2091"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ydb-platform/ydb-go-sdk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ydb-go-sdk\u0027s transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:17:49Z",
    "severity": "MODERATE"
  },
  "details": "Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.",
  "id": "GHSA-2c6m-4rmx-m2m7",
  "modified": "2026-08-11T18:30:51Z",
  "published": "2026-08-11T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20713"
    },
    {
      "type": "WEB",
      "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-20480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670",
      "CWE-783"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-25T17:15:17Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition that requires a manual reload to recover.  \n\n This vulnerability is due to improper handling of IPv4 DHCP packets. An attacker could exploit this vulnerability by sending certain IPv4 DHCP packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition that requires a manual reload to recover.",
  "id": "GHSA-2g8x-wxp8-jhpg",
  "modified": "2024-09-25T18:31:21Z",
  "published": "2024-09-25T18:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20480"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sda-edge-dos-MBcbG9k"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "hermes-engine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-1914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1119",
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-24T01:23:21Z",
    "nvd_published_at": "2020-10-08T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.",
  "id": "GHSA-327c-qx3v-h673",
  "modified": "2022-06-27T17:05:26Z",
  "published": "2022-05-24T17:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1914"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebook/hermes/issues/373"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facebook/hermes"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2020-1914"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Always-Incorrect Control Flow Implementation in Facebook Hermes"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-25745"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-13T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Memory corruption in modem due to improper input validation while handling the incoming CoAP message",
  "id": "GHSA-3288-5p9j-wphm",
  "modified": "2024-04-04T03:26:50Z",
  "published": "2023-04-13T09:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25745"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uglify-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "uglifier"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-8857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1254",
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:00Z",
    "nvd_published_at": "2017-01-23T21:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.\n\n## Recommendation\n\nUpgrade UglifyJS to version \u003e= 2.4.24.",
  "id": "GHSA-34r7-q49f-h37c",
  "modified": "2021-10-29T14:15:03Z",
  "published": "2017-10-24T18:33:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8857"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mishoo/UglifyJS2/issues/751"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mishoo/UglifyJS2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410"
    },
    {
      "type": "WEB",
      "url": "https://zyan.scripts.mit.edu/blog/backdooring-js"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-01T19:15:27Z",
    "severity": "MODERATE"
  },
  "details": "An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.",
  "id": "GHSA-39cp-8qfj-8cjm",
  "modified": "2024-07-03T18:38:27Z",
  "published": "2024-05-01T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33431"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stsaz/phiola/issues/27"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/flowPointException-1/flowPointException-1.assets/image-20240420004701828.png"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/flowPointException-1/flowPointException-1.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Helson-S/FuzzyTesting/blob/master/phiola/flowPointException-1/poc/I0I72U~G"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Helson-S/FuzzyTesting/tree/master/phiola/flowPointException-1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Helson-S/FuzzyTesting/tree/master/phiola/flowPointException-1/poc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stsaz/phiola"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T16:15:17Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: config: fix iteration issue in \u0027usb_get_bos_descriptor()\u0027\n\nThe BOS descriptor defines a root descriptor and is the base descriptor for\naccessing a family of related descriptors.\n\nFunction \u0027usb_get_bos_descriptor()\u0027 encounters an iteration issue when\nskipping the \u0027USB_DT_DEVICE_CAPABILITY\u0027 descriptor type. This results in\nthe same descriptor being read repeatedly.\n\nTo address this issue, a \u0027goto\u0027 statement is introduced to ensure that the\npointer and the amount read is updated correctly. This ensures that the\nfunction iterates to the next descriptor instead of reading the same\ndescriptor repeatedly.",
  "id": "GHSA-3pwm-r3r4-xpvf",
  "modified": "2025-09-25T18:30:28Z",
  "published": "2024-05-21T18:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52781"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64c27b7b2357ddb38b6afebaf46d5bff4d250702"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7c0244cc311a4038505b73682b7c8ceaa5c7a8c8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/974bba5c118f4c2baf00de0356e3e4f7928b4cbc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ef94ec8e52eaf7b9abc5b5f8f5b911751112223"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f89fef7710b2ba0f7a1e46594e530dcf2f77be91"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gofiber/fiber"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gofiber/fiber/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.49.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-670"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-08T13:27:21Z",
    "nvd_published_at": "2023-09-08T19:15:43Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThis vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the [ctx.IsFromLocal()](https://docs.gofiber.io/api/ctx#isfromlocal) method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost.\n\nIn it\u0027s implementation it uses c.IPs():\n\n```go\n// IPs returns a string slice of IP addresses specified in the X-Forwarded-For request header.\n// When IP validation is enabled, only valid IPs are returned.\nfunc (c *Ctx) IPs() []string {\n    return c.extractIPsFromHeader(HeaderXForwardedFor)\n}\n```\n\nThereby, setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for [ctx.IsFromLocal()](https://docs.gofiber.io/api/ctx#isfromlocal) \n\n### Patches\nThis issue has been patched in `v2.49.2` with commit [b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc](https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc)\n\n### Workarounds\nCurrently, there are no known workarounds to remediate this vulnerability without upgrading to the patched version. We strongly advise users to apply the patch as soon as it is released.\n\n### References\nFor further information and context regarding this security issue, please refer to the following resources:\n\n- [Mozilla Developer Network - X-Forwarded-For](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For)\n\n",
  "id": "GHSA-3q5p-3558-364f",
  "modified": "2023-09-11T14:39:57Z",
  "published": "2023-09-08T13:27:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41338"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For"
    },
    {
      "type": "WEB",
      "url": "https://docs.gofiber.io/api/ctx#isfromlocal"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gofiber/fiber"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`"
}