Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29890 State: PUBLISHED Published: 2025-08-29T17:14:52.094Z Last Updated: 2025-08-29T18:24:33.690Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4907 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advis
6.4907 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-19
CVE ID: CVE-2025-29891 State: PUBLISHED Published: 2025-03-12T14:42:59.644Z Last Updated: 2025-03-19T13:10:01.834Z Vendors: Apache Software Foundation Products: Apache Camel Problem Types: CWE-164 Description: Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean comp
er to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component. If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers. The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation. All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. This CVE is
camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box. This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://camel.apache.org/security/CVE-2025-27636.html - https://camel.apache.org/security/CVE-2025-29891.html
CVE ID: CVE-2025-29892 State: PUBLISHED Published: 2025-06-06T15:53:58.034Z Last Updated: 2025-06-06T16:35:18.667Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-10
CVE ID: CVE-2025-29893 State: PUBLISHED Published: 2025-08-29T17:14:59.151Z Last Updated: 2025-08-29T18:24:27.609Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-29894 State: PUBLISHED Published: 2025-08-29T17:15:06.045Z Last Updated: 2025-08-29T18:24:21.804Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-29898 State: PUBLISHED Published: 2025-08-29T17:15:12.723Z Last Updated: 2025-08-29T18:24:16.199Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-400, CWE-770 Description: An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-29899 State: PUBLISHED Published: 2025-08-29T17:15:20.147Z Last Updated: 2025-08-29T18:24:10.344Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4907 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advis
CVE ID: CVE-2025-29900 State: PUBLISHED Published: 2025-08-29T17:15:26.611Z Last Updated: 2025-08-29T18:24:02.562Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4907 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advis
CVE ID: CVE-2025-29901 State: PUBLISHED Published: 2025-08-26T09:35:52.521Z Last Updated: 2025-08-26T15:35:57.665Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-31
CVE ID: CVE-2025-29902 State: PUBLISHED Published: 2025-06-13T09:23:49.631Z Last Updated: 2025-06-13T12:22:47.798Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Telex, RTS Products: Remote Dispatch Console Server, VLink Virtual Matrix Software Problem Types: CWE-94 Description: Remote code execution that allows unauthorized users to execute arbitrary code on the server machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-992447.html
CVE ID: CVE-2025-29903 State: PUBLISHED Published: 2025-03-12T12:36:15.276Z Last Updated: 2025-03-12T13:51:16.357Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: Runtime Problem Types: CWE-426 Description: In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-29904 State: PUBLISHED Published: 2025-03-12T12:36:15.812Z Last Updated: 2025-03-12T13:15:49.900Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-444 Description: In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-29905 State: PUBLISHED Published: 2025-04-16T17:37:27.208Z Last Updated: 2025-04-16T18:04:16.027Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'RestoreFromBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
te to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25923) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-29906 State: PUBLISHED Published: 2025-04-29T22:17:47.228Z Last Updated: 2025-04-30T17:33:20.258Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: troglobit Products: finit Problem Types: CWE-287 Description: Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/troglobit/finit/security/advisories/GHSA-563g-p98j-mc9q
Notes: - CISA ADP Vulnrichment: References: - https://github.com/troglobit/finit/security/advisories/GHSA-563g-p98j-mc9q - https://github.com/troglobit/finit/commit/6528628b5c771c25ffa0cb1a46c6c89d9d0d69e0
CVE ID: CVE-2025-29907 State: PUBLISHED Published: 2025-03-18T18:40:57.504Z Last Updated: 2025-03-18T19:02:49.720Z Vendors: parallax Products: jsPDF Problem Types: CWE-400, CWE-770 Description: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
nd addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parallax/jsPDF/security/advisories/GHSA-w532-jxjh-hjhj - https://github.com/parallax/jsPDF/commit/b167c43c27c466eb914b927885b06073708338df
CVE ID: CVE-2025-29908 State: PUBLISHED Published: 2025-03-31T18:43:44.172Z Last Updated: 2025-04-01T13:50:43.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: netty Products: netty-incubator-codec-quic Problem Types: CWE-407 Description: Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final. Additional Analyst Notes: - CISA
h colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x2 - https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c - https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
CVE ID: CVE-2025-29909 State: PUBLISHED Published: 2025-03-17T21:55:14.979Z Last Updated: 2025-03-18T13:25:26.020Z Vendors: nasa Products: CryptoLib Problem Types: CWE-191, CWE-787 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in CryptoLib's `Crypto_TC_ApplySecurity()` allows an attacker to craft a malicious TC frame that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, rem
me that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, remote code execution (RCE). Any application or system that relies on CryptoLib for Telecommand (TC) processing and does not strictly validate incoming TC frames is at risk. This includes satellite ground stations or mission control software where attackers can inject malformed frames. A patch is available at commit c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-q2pc-c3jx-3852 - https://github.com/nasa/CryptoLib/commit/c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc
CVE ID: CVE-2025-29910 State: PUBLISHED Published: 2025-03-17T22:04:34.724Z Last Updated: 2025-03-18T13:21:17.751Z Vendors: nasa Products: CryptoLib Problem Types: CWE-401 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A memory leak vulnerability was identified in the `crypto_handle_incrementing_nontransmitted_counter` function of CryptoLib versions 1.3.3 and prior. This vulnerability can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes o
lity can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes or systems processing large volumes of data. The vulnerability is present in the `crypto_handle_incrementing_nontransmitted_counter` function within `crypto_tc.c`. The function allocates memory using `malloc` without ensuring the allocated memory is always freed. This issue can lead to resource exhaustion, reduced system performance, and potentially a Denial of Service (DoS) in environments where CryptoLib is used in long-running processes or with large volumes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be
umes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted. As of time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5
CVE ID: CVE-2025-29911 State: PUBLISHED Published: 2025-03-17T22:20:15.289Z Last Updated: 2025-03-18T13:17:45.829Z Vendors: nasa Products: CryptoLib Problem Types: CWE-122 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSecurity` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a malic
allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted AOS frame with an insufficient length. The vulnerability lies in the function `Crypto_AOS_ProcessSecurity`, specifically during the processing of the Frame Error Control Field (FECF). The affected code attempts to read from the `p_ingest` buffer at indices `current_managed_parameters_struct.max_frame_size - 2` and `current_managed_parameters_struct.max_frame_size - 1` without verifying if `len_ingest` is sufficiently large. This leads to a heap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched vers
eap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-7g6g-9gj4-8c68
CVE ID: CVE-2025-29912 State: PUBLISHED Published: 2025-03-17T22:48:40.833Z Last Updated: 2025-03-18T13:31:28.409Z Vendors: nasa Products: CryptoLib Problem Types: CWE-122, CWE-191 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, an unsigned integer underflow in the `Crypto_TC_ProcessSecurity` function of CryptoLib leads to a heap buffer overflow. The vulnerability is triggered when the `fl` (frame length) field in a Telecommand (TC) packet is set to 0. This underflow cau
lnerability is triggered when the `fl` (frame length) field in a Telecommand (TC) packet is set to 0. This underflow causes the frame length to be interpreted as 65535, resulting in out-of-bounds memory access. This critical vulnerability can be exploited to cause a denial of service (DoS) or potentially achieve remote code execution. Users of CryptoLib are advised to apply the recommended patch or avoid processing untrusted TC packets until a fix is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-3f5x-r59x-p8cf - https://github.com/nasa/CryptoLib/commit/ca39cb96f21e76102aefb956d2c8c0ba0bd143ca
CVE ID: CVE-2025-29913 State: PUBLISHED Published: 2025-03-17T22:50:49.074Z Last Updated: 2025-03-18T14:07:35.486Z Vendors: nasa Products: CryptoLib Problem Types: CWE-125, CWE-191 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a mali
allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted telecommand (TC) frame that causes an unsigned integer underflow. The vulnerability lies in the function `Crypto_TC_Prep_AAD`, specifically during the computation of `tc_mac_start_index`. The affected code incorrectly calculates the MAC start index without ensuring it remains within the bounds of the `ingest` buffer. When `tc_mac_start_index` underflows due to an incorrect length calculation, the function attempts to access an out-of-bounds memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3
memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3cc420ace96d02a5b7e83d88cbd2e48010d5723`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-q4v2-fvrv-qrf6
CVE ID: CVE-2025-29914 State: PUBLISHED Published: 2025-03-20T17:44:59.024Z Last Updated: 2025-03-20T18:18:27.514Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: corazawaf Products: coraza Problem Types: CWE-706 Description: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3. Additional Analyst Notes: - CISA ADP Vulnric
php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/corazawaf/coraza/security/advisories/GHSA-q9f5-625g-xm39 - https://github.com/corazawaf/coraza/commit/4722c9ad0d502abd56b8d6733c6b47eb4111742d
CVE ID: CVE-2025-29915 State: PUBLISHED Published: 2025-04-10T19:51:48.289Z Last Updated: 2025-04-10T20:05:50.746Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: OISF Products: suricata Problem Types: CWE-347 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds w
e MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp - https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d - https://redmine.openinfosecfoundation.org/issues/5373
CVE ID: CVE-2025-29916 State: PUBLISHED Published: 2025-04-10T20:03:16.834Z Last Updated: 2025-04-10T20:21:27.471Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-770 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9. Add
ocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-27g3-pmvp-j9cv - https://github.com/OISF/suricata/commit/a7713db709b8a0be5fc5e5809ab58e9b14a16e85 - https://redmine.openinfosecfoundation.org/issues/7615