deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.0.5
Patched in: 2.0.5

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-6jvm-3j5h-79f6
Package: paperclip (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.2.2
Patched in: 4.2.2

Summary: paperclip Cross-site Scripting vulnerability

Details:
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
GitHub Security Advisory: GHSA-vxvp-4xwc-jpp6
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.2.0, < 4.2.2
Patched in: 4.2.2

Summary: activesupport Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `json/encoding.rb` in Active Support in Ruby on Rails 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
GitHub Security Advisory: GHSA-vxvp-4xwc-jpp6
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.1.0, < 4.1.11
Patched in: 4.1.11

Summary: activesupport Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `json/encoding.rb` in Active Support in Ruby on Rails 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
GitHub Security Advisory: GHSA-mx9f-w8qq-q5jf
Package: rest-client (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.7.3
Patched in: 1.7.3

Summary: rest-client allows local users to obtain sensitive information by reading the log

Details:
REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.
GitHub Security Advisory: GHSA-59c7-4xj2-hgvw
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: rails-html-sanitizer Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
GitHub Security Advisory: GHSA-r9c2-cr39-c8g6
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: rails-html-sanitizer Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the `Rails::Html::FullSanitizer` class.
GitHub Security Advisory: GHSA-ghqm-pgxj-37gq
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: rails-html-sanitizer Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `lib/rails/html/scrubbers.rb` in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
GitHub Security Advisory: GHSA-f7f4-5w9j-23p2
Package: festivaltts4r (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.2.0
Patched in: unpatched

Summary: festivaltts4r allows arbitrary command execution

Details:
The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) `to_speech` or (2) `to_mp3` method in `lib/festivaltts4r/festival4r.rb`.
GitHub Security Advisory: GHSA-j5hj-fhc9-g24m
Package: rack-mini-profiler (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.10.1
Patched in: 0.10.1

Summary: rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects

Details:
The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
GitHub Security Advisory: GHSA-6h88-qjpv-p32m
Package: openssl (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: OpenSSL gem for Ruby using inadequate encryption strength

Details:
The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
GitHub Security Advisory: GHSA-f3jg-756w-gm35
Package: github.com/safedep/gryph (GO)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: <= 0.6.0
Patched in: 0.7.0

Summary: Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

Details:
Gryph implements logging levels that determine what content is logged to a local sqlite database. The README incorrectly mentions that the default log level is minimal while it is standard.  Source code review shows sensitive `file-write` content remains in the stored `payload` as `ContentPreview`, `OldString`, or `NewString` at the default `standard` logging level and at `full`. This leads to logging of potentially sensitive file content in the local sqlite database, violating Gryphs sensitive file filter and log level contracts. 

### Impact

Potentially sensitive data accessed or written by coding agents may be logged to local sqlite database. Users of Gryph are affected ONLY if their local sqlite database is stolen or exported to remote system with the assumption that no sensitive data is logged.

### Patches

Fixed in v0.7.0
GitHub Security Advisory: GHSA-6cmp-qv2f-x97x
Package: www.velocidex.com/golang/velociraptor (GO)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 0.76.5
Patched in: 0.76.5

Summary: Velocidex Velociraptor has an off-by-one error

Details:
An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parse_evtx VQL plugin.
GitHub Security Advisory: GHSA-3c93-g9g6-p5j4
Package: www.velocidex.com/golang/velociraptor (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 0.76.5
Patched in: 0.76.5

Summary: Velocidex Velociraptor has an authorization bypass vulnerability

Details:
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.
GitHub Security Advisory: GHSA-39qr-rc93-vhqm
Package: github.com/xddxdd/bird-lg-go (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.0.0[PII_REDACTED]0110-0ff87024cb9e
Patched in: 0.0.0[PII_REDACTED]0110-0ff87024cb9e

Summary: Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding

Details:
### Summary
The `apiHandler` (and similarly `webHandlerTelegramBot`) processes user-provided JSON payloads by directly using `json.NewDecoder(r.Body).Decode(&request)` without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable `fatal error: runtime: out of memory`. 

This causes the Linux OOM Killer to instantly terminate the entire `bird-lg-go` daemon, resulting in a severe Remote Denial of Service (RDoS).

### Details
In `api.go`:
```go
func apiHandler(w http.ResponseWriter, r *http.Request) {
    var request apiRequest
    // VULNERABILITY: No http.MaxBytesReader protection before JSON decode
    err := json.NewDecoder(r.Body).Decode(&request) 
    // ...
GitHub Security Advisory: GHSA-w88c-9vg8-cmq8
Package: github.com/osrg/gobgp (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 4.4.0
Patched in: 4.4.0

Summary: GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer

Details:
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
GitHub Security Advisory: GHSA-mc29-hmx6-856q
Package: github.com/ellanetworks/core (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-358: Improperly Implemented Security Check for Standard
Vulnerable versions: < 1.10.0
Patched in: 1.10.0

Summary: Ella Core has handover failures during concurrent Security Mode Command

Details:
## Summary

Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).

## Impact

Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger.

## Fix

Ella Core now enforces both rules from §6.9.5.1, blocking concurrent Security Mode Command and N2 handover procedures.
GitHub Security Advisory: GHSA-pwfh-mqp3-pqwj
Package: github.com/ellanetworks/core (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-358: Improperly Implemented Security Check for Standard
Vulnerable versions: < 1.10.0
Patched in: 1.10.0

Summary: Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

Details:
## Summary

Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest.

## Impact

A gNB can corrupt Ella Core's stored UE security capabilities for a target UE.

## Fix

The PathSwitchRequest handler now compares the received UE Security Capabilities against Ella Core's locally stored values, preserves the stored values on mismatch, returns them in the PathSwitchRequestAcknowledge, and logs the event.
GitHub Security Advisory: GHSA-qfxw-v8qx-vj3v
Package: github.com/ellanetworks/core (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-358: Improperly Implemented Security Check for Standard, CWE-863: Incorrect Authorization
Vulnerable versions: < 1.10.0
Patched in: 1.10.0

Summary: Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

Details:
## Summary

A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio.

## Impact

Downlink user-plane traffic for the targeted UE is redirected to the attacker's radio.

## Fix

UE context lookups are now scoped to the sending radio's SCTP association.
GitHub Security Advisory: GHSA-2v93-vp82-cjv8
Package: www.velocidex.com/golang/velociraptor (GO)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 0.76.4
Patched in: 0.76.4

Summary: Velocidex Velociraptor has an Incorrect Authorization issue

Details:
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.



However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
GitHub Security Advisory: GHSA-389r-gv7p-r3rp
Package: github.com/go-git/go-git/v5 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-180: Incorrect Behavior Order: Validate Before Canonicalize, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 5.19.0
Patched in: 5.19.0

Summary: go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Details:
### Impact
`go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or malformed headers, `go-git`’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.

Additionally, `go-git`’s commit signing and verification logic operates over commit data reconstructed from `go-git`’s parsed representation rather than the original raw object bytes. As a result, `go-git` may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.

This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.

### Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.

### Credit

Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to `sigstore/gitsign`, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the `go-git` project. :bow: :1st_place_medal: 

Thanks to @wayphinder for reporting this to the `go-git` project. :bow:
GitHub Security Advisory: GHSA-389r-gv7p-r3rp
Package: github.com/go-git/go-git/v6 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-180: Incorrect Behavior Order: Validate Before Canonicalize, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.0.0-alpha.1, <= 6.0.0-alpha.2
Patched in: 6.0.0-alpha.3

Summary: go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Details:
### Impact
`go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or malformed headers, `go-git`’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.

Additionally, `go-git`’s commit signing and verification logic operates over commit data reconstructed from `go-git`’s parsed representation rather than the original raw object bytes. As a result, `go-git` may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.

This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.

### Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.

### Credit

Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to `sigstore/gitsign`, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the `go-git` project. :bow: :1st_place_medal: 

Thanks to @wayphinder for reporting this to the `go-git` project. :bow:
GitHub Security Advisory: GHSA-28gr-56hr-prp6
Package: github.com/grafana/tempo-operator (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.16.0
Patched in: 0.16.0

Summary: Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Details:
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.
GitHub Security Advisory: GHSA-5xf3-gmx4-529v
Package: github.com/grafana/tempo-operator (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.16.0
Patched in: 0.16.0

Summary: Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Details:
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.
This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
GitHub Security Advisory: GHSA-cqp7-wf4c-3xgc
Package: github.com/grafana/grafana (GO)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 12.3.0, < 12.3.3
Patched in: 12.3.3

Summary: Grafana has a Cross-site Scripting issue

Details:
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
GitHub Security Advisory: GHSA-cqp7-wf4c-3xgc
Package: github.com/grafana/grafana (GO)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 12.2.0, < 12.2.5
Patched in: 12.2.5

Summary: Grafana has a Cross-site Scripting issue

Details:
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
GitHub Security Advisory: GHSA-cmpj-2x3g-m7g3
Package: github.com/free5gc/nef (GO)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-862: Missing Authorization
Vulnerable versions: <= 1.2.3
Patched in: unpatched

Summary: free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

Details:
### Summary
free5GC's NEF mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no `Authorization` header at all and the handler returns `200 OK`. The current OAM handler is a stub that returns `null`, but the structural defect is route-group-scoped: the entire OAM route group has no inbound auth middleware, so every future OAM operation added to this group inherits the missing auth boundary by default. Same root cause as the NEF traffic-influence and PFD-management findings.

### Details
Validated against the NEF container in the official Docker compose lab.
- Source repo tag: `v4.2.1`
- Running Docker image: `free5gc/nef:v4.2.0`
- Runtime NEF commit: `5ce35eab`
- Docker validation date: 2026-03-11

NEF advertises `OAuth2 setting receive from NRF: true`, yet the OAM route group is mounted without any inbound auth middleware and answers unauthenticated `GET`s with `200 OK`.

Code evidence (paths in `free5gc/nef`):
- OAM route group mounted without auth middleware: `NFs/nef/internal/sbi/server.go:60`
- OAM route exposed at `/`: `NFs/nef/internal/sbi/api_oam.go:9`
- OAM processor returns `200 OK` directly: `NFs/nef/internal/sbi/processor/oam.go:9`
- NEF context only exposes outbound token acquisition (`GetTokenCtx`); there is no inbound authorization path: `NFs/nef/internal/context/nef_context.go:153`

### PoC
Reproduced against the running NEF at `http://10.100.200.19:8000` with no `Authorization` header:

```
curl -i http://10.100.200.19:8000/nnef-oam/v1/
```

Observed output:
```
HTTP/1.1 200 OK
null
```

NEF container logs (`docker logs nef`) show the request being served while OAuth is enabled:
```
[INFO][NEF][GIN] | 200 | GET | /nnef-oam/v1/
```

### Impact
Missing inbound authentication (CWE-306) and authorization (CWE-862) on the NEF OAM SBI route group. Severity is scored against the OAM route group's intended capability surface (Operations / Administration / Maintenance), NOT against the current stub handler. The current handler is a stub that returns `null`, but the defect is route-group-scoped: there is no auth middleware on the group at all, so every future OAM operation added behind this group inherits the missing inbound auth boundary by default.

Any party that can reach NEF on the SBI can:
- Probe and enumerate the OAM route surface anonymously today.
- Hit any future OAM-group endpoint (read, modify, restart-style operations) anonymously, because the auth boundary does not exist for this group.

Operators who assume `OAuth2 setting receive from NRF: true` enforces inbound auth on NEF are wrong for this route group.

Affected: free5gc v4.2.1.

Upstream issue: https://github.com/free5gc/free5gc/issues/861
Upstream fix: https://github.com/free5gc/nef/pull/23