{"vulnerability": "cve-2026-7184", "sightings": [{"uuid": "844fea00-c91b-4186-91ea-9b8f34c48b8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71847", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7igh6tff3f5ib", "content": "CVE-2026-71847 - Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams\nCVE ID : CVE-2026-71847\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : Ruby JSON is a JSON implementation ...", "creation_timestamp": "2026-08-07T20:07:36.814034Z"}, {"uuid": "d0b8a001-f946-4519-ad69-15a5e1ca56a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71847", "type": "published-proof-of-concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "content": "", "creation_timestamp": "2026-08-07T20:35:09.126281Z"}, {"uuid": "a0a541b9-9464-420e-95df-afd6fdc32f01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71849", "type": "seen", "source": "https://gist.github.com/alon710/5988f40586bcc25ff4d614f1ea49845f", "content": "# CVE-2026-71849: CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71849\n\n## Summary\nA vulnerability in the Hono framework's Proxy Helper allows the exposure of connection-scoped, internal, or session-specific metadata to unauthorized actors. The proxy helper fails to remove header fields dynamically listed in the response's Connection header, violating RFC 9110 Section 7.6.1.\n\n## TL;DR\nHono's proxy helper failed to dynamically strip custom connection-scoped headers specified in the response's Connection header, leading to information leakage of internal transit headers to clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Information Exposure\n- **Exploit Status**: None / Theoretical\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- hono\n- **hono**: >= 4.7.0, < 4.12.34 (Fixed in: `4.12.34`)\n\n## Mitigation\n\n- Upgrade Hono to version 4.12.34 or higher\n- Implement a manual middleware wrapper to parse and delete connection-scoped headers\n\n**Remediation Steps:**\n1. Identify all service entrypoints using `hono/proxy`\n2. Update package.json to require hono version 4.12.34 or above\n3. Execute npm install, yarn install, pnpm install, or bun install to apply the change\n4. Verify proxy responses no longer contain headers specified in the Connection header\n\n## References\n\n- [GitHub Security Advisory GHSA-79qm-7rj5-m7r9](https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9)\n- [Fix Commit](https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f)\n- [Hono Release v4.12.34](https://github.com/honojs/hono/releases/tag/v4.12.34)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71849)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71849) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T23:35:49.259988Z"}, {"uuid": "68f8d534-4423-45cd-9a8e-f95802d460af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71849", "type": "seen", "source": "https://gist.github.com/alon710/5988f40586bcc25ff4d614f1ea49845f", "content": "# CVE-2026-71849: CVE-2026-71849: Information Exposure via Hop-by-Hop Header Leakage in Hono Proxy Helper\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71849\n\n## Summary\nA vulnerability in the Hono framework's Proxy Helper allows the exposure of connection-scoped, internal, or session-specific metadata to unauthorized actors. The proxy helper fails to remove header fields dynamically listed in the response's Connection header, violating RFC 9110 Section 7.6.1.\n\n## TL;DR\nHono's proxy helper failed to dynamically strip custom connection-scoped headers specified in the response's Connection header, leading to information leakage of internal transit headers to clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Information Exposure\n- **Exploit Status**: None / Theoretical\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- hono\n- **hono**: >= 4.7.0, < 4.12.34 (Fixed in: `4.12.34`)\n\n## Mitigation\n\n- Upgrade Hono to version 4.12.34 or higher\n- Implement a manual middleware wrapper to parse and delete connection-scoped headers\n\n**Remediation Steps:**\n1. Identify all service entrypoints using `hono/proxy`\n2. Update package.json to require hono version 4.12.34 or above\n3. Execute npm install, yarn install, pnpm install, or bun install to apply the change\n4. Verify proxy responses no longer contain headers specified in the Connection header\n\n## References\n\n- [GitHub Security Advisory GHSA-79qm-7rj5-m7r9](https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9)\n- [Fix Commit](https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f)\n- [Hono Release v4.12.34](https://github.com/honojs/hono/releases/tag/v4.12.34)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71849)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71849) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:02:49.294421Z"}, {"uuid": "6b4b07dc-9010-49be-878f-489ad966e83b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71848", "type": "seen", "source": "https://gist.github.com/alon710/b3f3e72bf33c744afdd90509c65dceb1", "content": "# CVE-2026-71848: CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71848\n\n## Summary\nAn Algorithmic Complexity Denial of Service (DoS) vulnerability exists in the Hono web application framework within its languageDetector middleware. From version 4.12.0 to 4.12.33, the progressive language-tag truncation routine (normalizeLanguage) performs string operations with a quadratic time complexity O(N^2) relative to the number of hyphen-separated subtags in the user-supplied language tag. This allows an unauthenticated remote attacker to cause resource exhaustion and CPU spikes, resulting in a full denial of service of the single-threaded JavaScript runtime.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete Denial of Service (DoS) in Hono applications running versions 4.12.0 to 4.12.33 by sending excessively long hyphen-separated language strings in headers, cookies, or query parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- Hono Framework languageDetector Middleware\n- **hono**: >= 4.12.0, <= 4.12.33 (Fixed in: `4.12.34`)\n\n## Mitigation\n\n- Upgrade the Hono dependency to version 4.12.34 or higher to resolve the quadratic complexity loop.\n- Configure reverse proxies or web application firewalls to restrict the maximum length of the Accept-Language header.\n- Deploy custom WAF rules to block incoming headers, query parameters, or cookies containing repeating hyphenated characters.\n\n**Remediation Steps:**\n1. Execute `npm install hono@4.12.34` or update the lockfile using your package manager.\n2. Audit existing endpoints utilizing the languageDetector middleware.\n3. Test client endpoints with a test script verifying that long inputs are handled in O(1) time without blocking the event loop.\n\n## References\n\n- [GitHub Security Advisory GHSA-54fx-42gc-7vw4](https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4)\n- [Fix Commit f70e2c316](https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71848) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:34:16.779059Z"}, {"uuid": "dd656878-d76a-4b83-8dbc-ca30dd359c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71847", "type": "seen", "source": "https://gist.github.com/alon710/ad9de868f19ed1752a611a888e617195", "content": "# CVE-2026-71847: CVE-2026-71847: Use-After-Free in Ruby JSON Gem ResumableParser\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71847\n\n## Summary\nA technical analysis of the use-after-free (UAF) vulnerability in the Ruby JSON gem (CVE-2026-71847) that impacts versions 2.20.0 through 2.21.1. This vulnerability occurs when parsing incomplete stream data containing duplicate keys.\n\n## TL;DR\nA Use-After-Free (UAF) bug in the native C extension of the Ruby json gem allows remote attackers to trigger a process crash and denial of service via malformed streaming JSON data with duplicate keys.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.7 (High)\n- **Exploit Status**: PoC (Proof of Concept)\n- **Impact**: Denial of Service (Process Crash)\n- **Affected Gem Versions**: >= 2.20.0, < 2.21.2\n\n## Affected Systems\n\n- Ruby applications utilizing the JSON::ResumableParser class in json gem versions 2.20.0 to 2.21.1.\n- **json (gem)**: >= 2.20.0, < 2.21.2 (Fixed in: `2.21.2`)\n\n## Mitigation\n\n- Upgrade the 'json' gem to version 2.21.2 or newer.\n- Filter incoming stream payloads for duplicate object keys before passing to the parser.\n- Implement automatic process restarts for worker nodes.\n\n**Remediation Steps:**\n1. Update the Gemfile dependency: gem 'json', '>= 2.21.2'\n2. Run 'bundle update json' to update the lockfile.\n3. Deploy the updated code to production environments.\n4. Verify the version with 'bundle info json'.\n\n## References\n\n- [GitHub Security Advisory GHSA-9hj4-r449-hfvc](https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc)\n- [CVE-2026-71847 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71847)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71847) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T01:33:52.623224Z"}, {"uuid": "a521eff5-cf22-47ba-b60a-dda2f81edf87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71846", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7lhunq4xxei6a", "content": "CVE-2026-71846 - Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege\nCVE ID : CVE-2026-71846\n \n Published : Aug. 12, 2026, 9:46 p.m. | 43\u00a0minutes ago\n \n Description : A flaw was found in insights-client. The component...", "creation_timestamp": "2026-08-12T23:03:25.035949Z"}]}