Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25123 State: PUBLISHED Published: 2023-07-06T14:53:27.013Z Last Updated: 2025-11-04T19:15:38.282Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-121 Description: Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables when action is 2. Add
low occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables when action is 2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716
CVE ID: CVE-2023-25124 State: PUBLISHED Published: 2023-07-06T14:53:27.093Z Last Updated: 2025-11-04T19:15:39.377Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-121 Description: Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables. Additional Analyst N
low occurs in the set_openvpn_client function with the remote_subnet and the remote_mask variables. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1716
CVE ID: CVE-2023-25125 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25126 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25127 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25128 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25129 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25130 State: REJECTED Published: N/A Last Updated: 2023-02-03T00:00:00 Description: No description available.
CVE ID: CVE-2023-25131 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T17:25:51.219Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: CyberPower Products: PowerPanel Business Local / Remote, PowerPanel Business Management Problem Types: CWE-1393 Description: Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, Po
s Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the 'admin' password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ - https://www.cyberpower.com/global/en/product/sku/powerpanel_busines
nrichment: References: - https://zuso.ai/Advisory/ - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
CVE ID: CVE-2023-25132 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T17:25:19.666Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel Business Local / Remote, PowerPanel Business Management Problem Types: CWE-434 Description: Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Manage
2bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads - https://www.cyberpower.com/global/en/product/sku
r.com/global/en/product/sku/powerpanel_business_for_windows#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
CVE ID: CVE-2023-25133 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T17:22:44.012Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel Business Local / Remote, PowerPanel Business Management Problem Types: CWE-269 Description: Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32b
rlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_busine
oduct/sku/powerpanel_business_for_windows#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads
CVE ID: CVE-2023-25134 State: PUBLISHED Published: 2023-03-21T00:00:00.000Z Last Updated: 2025-02-28T21:54:05.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in the Windows Registry. This can result in the loading of a malicious payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html - https://www.mcafee.com/support/?articleId=TS103398&page=shell&shell=article-view
CVE ID: CVE-2023-25135 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T14:52:17.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable - https://forum.vbulletin.c
chment: References: - https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
CVE ID: CVE-2023-25136 State: PUBLISHED Published: 2023-02-03T00:00:00 Last Updated: 2024-08-02T11:18:35.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible." Additional Analyst Notes: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig - https://www.openwall.
ntainer: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig - https://www.openwall.com/lists/oss-security/2023/02/02/2 - https://bugzilla.mindrot.org/show_bug.cgi?id=3522 - https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 - https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ - https://news.ycombinator.com/item?id=34711565 - http://www.openwall.com/lists/oss-security/2023/02/13/1 - http://www.openwall.com/lists/oss-security/2023/02/22/1 - http://www.openwall.com/lists/oss-security/2023/02/22/2 - http://www.openwall.com/lists/oss-security/2023/02/23/3 - http://www.openwa
enwall.com/lists/oss-security/2023/02/22/2 - http://www.openwall.com/lists/oss-security/2023/02/23/3 - http://www.openwall.com/lists/oss-security/2023/03/06/1 - http://www.openwall.com/lists/oss-security/2023/03/09/2 - https://security.netapp.com/advisory/ntap-20230309-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ - https://security.gentoo.org/glsa/202307-01
CVE ID: CVE-2023-25139 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T14:49:09.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes. Additional Analyst Notes: - CVE Program Container: - CISA A
mple, 1,234,567 (with padding to 13) overflows by two bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=30068 - http://www.openwall.com/lists/oss-security/2023/02/10/1 - https://security.netapp.com/advisory/ntap-20230302-0010/
CVE ID: CVE-2023-25140 State: PUBLISHED Published: 2023-02-14T10:37:08.574Z Last Updated: 2025-03-19T18:53:35.636Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V34.0, Parasolid V34.1, Parasolid V35.0, Parasolid V35.1, Solid Edge SE2022 Problem Types: CWE-125 Description: A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.254), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150), Solid Edge SE2022 (All versions < V222.0MP12). The affected applications contain an out of bounds read past the end of an allocated stru
2 (All versions < V222.0MP12). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf
CVE ID: CVE-2023-25141 State: PUBLISHED Published: 2023-02-14T12:12:21.224Z Last Updated: 2025-03-20T18:11:22.386Z Vendors: Apache Software Foundation Products: Apache Sling JCR Base Problem Types: CWE-74 Description: Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI. Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK. Additional Analyst Notes: - CVE Progra
upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sling.apache.org/news.html
CVE ID: CVE-2023-25143 State: PUBLISHED Published: 2023-03-07T22:19:14.593Z Last Updated: 2025-03-05T14:45:38.681Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209
CVE ID: CVE-2023-25144 State: PUBLISHED Published: 2023-03-07T22:19:31.521Z Last Updated: 2025-03-06T16:04:16.277Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209 - https://www.zerodayinitiative.com/advisories/ZDI-23-171/
CVE ID: CVE-2023-25145 State: PUBLISHED Published: 2023-03-07T22:19:42.286Z Last Updated: 2025-03-05T20:48:30.127Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209 - https://www.zerodayinitiative.com/advisor
ulnrichment: References: - https://success.trendmicro.com/solution/000292209 - https://www.zerodayinitiative.com/advisories/ZDI-23-174/
CVE ID: CVE-2023-25146 State: PUBLISHED Published: 2023-03-07T22:19:52.381Z Last Updated: 2025-03-05T20:45:51.729Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP
the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209 - https://www.zerodayinitiative.com/advisories/ZDI-23-172/
CVE ID: CVE-2023-25147 State: PUBLISHED Published: 2023-03-07T22:20:04.864Z Last Updated: 2025-03-05T20:43:49.976Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209
CVE ID: CVE-2023-25148 State: PUBLISHED Published: 2023-03-07T22:20:13.080Z Last Updated: 2025-03-05T20:42:50.654Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: n/a Description: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendm
bility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000292209 - https://www.zerodayinitiative.com/advisories/ZDI-23-173/
CVE ID: CVE-2023-25149 State: PUBLISHED Published: 2023-02-14T13:44:37.713Z Last Updated: 2025-03-10T21:12:25.827Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: timescale Products: timescaledb Problem Types: CWE-284 Description: TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the telemetry data collection were not run with a locked down `search_path`, allowing malicious users to create functions that would be executed by the telemetry job, leading to privileg
rch_path`, allowing malicious users to create functions that would be executed by the telemetry job, leading to privilege escalation. In order to be able to take advantage of this vulnerability, a user would need to be able to create objects in a database and then get a superuser to install TimescaleDB into their database. When TimescaleDB is installed as trusted extension, non-superusers can install the extension without help from a superuser. Version 2.9.3 fixes this issue. As a mitigation, the `search_path` of the user running the telemetry job can be locked down to not include schemas writable by other users. The vulnerability is not exploitable on instances in Timescale Cloud and Manage
include schemas writable by other users. The vulnerability is not exploitable on instances in Timescale Cloud and Managed Service for TimescaleDB due to additional security provisions in place on those platforms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/timescale/timescaledb/security/advisories/GHSA-44jh-j22r-33wq - https://github.com/timescale/timescaledb/pull/5259 - https://github.com/timescale/timescaledb/releases/tag/2.9.3
CVE ID: CVE-2023-25150 State: PUBLISHED Published: 2023-02-08T19:15:47.344Z Last Updated: 2025-03-10T21:14:57.395Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextclo
is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64xc-r58v-53gj - https://github.com/nextcloud/richdocuments/pull/2669 - https://hackerone.com/reports/1788222
CVE ID: CVE-2023-25151 State: PUBLISHED Published: 2023-02-08T19:21:37.401Z Last Updated: 2025-03-10T21:14:51.700Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-telemetry Products: opentelemetry-go-contrib Problem Types: CWE-400 Description: opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` att
esponse_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue. Addition
been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh - https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159