deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9f3f-wv7r-qc8r
Package: github.com/pion/dtls (GO)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 1.5.4
Patched in: unpatched

Summary: Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key

Details:
### Impact
Pion DTLS versions v1.0.0 through v3.0.10 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". 

### Patches
Upgrade to v3.1.1 or later. This version includes PR #796, which uses the 64-bit sequence number to populate the `nonce_explicit` part of the GCM nonce. This is according to best practice outlined in [RFC 9325 section 7.2.1](https://www.rfc-editor.org/rfc/rfc9325#section-7.2.1). 

v3.0.11 is a backport patch supporting Go v1.21

### Workarounds
There are no workarounds without upgrading to version v3.0.11, v3.1.1 or later.

### References
Commit fixing the bug: https://github.com/pion/dtls/commit/61762dee[PII_REDACTED]c5eb79856b9e7a73ee349f
Commit fixing the bug (backport): 90e241c
Pull request: #796
GitHub Security Advisory: GHSA-9f3f-wv7r-qc8r
Package: github.com/pion/dtls/v2 (GO)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2.2.12
Patched in: unpatched

Summary: Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key

Details:
### Impact
Pion DTLS versions v1.0.0 through v3.0.10 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". 

### Patches
Upgrade to v3.1.1 or later. This version includes PR #796, which uses the 64-bit sequence number to populate the `nonce_explicit` part of the GCM nonce. This is according to best practice outlined in [RFC 9325 section 7.2.1](https://www.rfc-editor.org/rfc/rfc9325#section-7.2.1). 

v3.0.11 is a backport patch supporting Go v1.21

### Workarounds
There are no workarounds without upgrading to version v3.0.11, v3.1.1 or later.

### References
Commit fixing the bug: https://github.com/pion/dtls/commit/61762dee[PII_REDACTED]c5eb79856b9e7a73ee349f
Commit fixing the bug (backport): 90e241c
Pull request: #796
GitHub Security Advisory: GHSA-34cx-hvm4-vx7j
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-287: Improper Authentication, CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: >= 3.10.0, < 3.10.1
Patched in: 3.10.1

Summary: Mattermost Server password reset email requests can be sent to attacker-provided email addresses

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address.
GitHub Security Advisory: GHSA-34cx-hvm4-vx7j
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-287: Improper Authentication, CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: < 3.9.1-rc1
Patched in: 3.9.1-rc1

Summary: Mattermost Server password reset email requests can be sent to attacker-provided email addresses

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address.
GitHub Security Advisory: GHSA-r6j5-fqx9-7qv9
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 3.8.1-0[PII_REDACTED]1128-4f074fed0d65
Patched in: 3.8.1-0[PII_REDACTED]1128-4f074fed0d65

Summary: Mattermost Server SAML implementation does not require encryption or signature verification as default

Details:
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
GitHub Security Advisory: GHSA-fpcr-4rr5-hpcp
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: >= 3.10.0, < 3.10.2
Patched in: 3.10.2

Summary: Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
GitHub Security Advisory: GHSA-fpcr-4rr5-hpcp
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 3.9.2-0[PII_REDACTED]4023-b17fca0d5ee7
Patched in: 3.9.2-0[PII_REDACTED]4023-b17fca0d5ee7

Summary: Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
GitHub Security Advisory: GHSA-37cx-329c-33x3
Package: github.com/go-git/go-git/v5 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-354: Improper Validation of Integrity Check Value
Vulnerable versions: <= 5.16.4
Patched in: 5.16.5

Summary: go-git improperly verifies data integrity values for .idx and .pack files

Details:
### Impact 

A vulnerability was discovered in `go-git` whereby data integrity values for `.pack` and `.idx` files were not properly verified. This resulted in `go-git` potentially consuming corrupted files, which would likely result in unexpected errors such as `object not found`.

For context, clients fetch [`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data) from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (`.idx`) are [generated](https://git-scm.com/docs/pack-format) locally by `go-git`, or the `git` cli, when new `.pack` files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of `https://` or known hosts for `ssh://`). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

### Patches

Users should upgrade to `v5.16.5`, or the latest `v6` [pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to mitigate this vulnerability.

### Workarounds

In case updating to a fixed version of `go-git` is not possible, users can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli to check for data corruption on a given repository. 

### Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the `go-git` project.
GitHub Security Advisory: GHSA-5ghq-28r7-qwfj
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.7.0, < 3.7.3
Patched in: 3.7.3

Summary: Mattermost Server does not restrict SAML certificate path for System Administrators

Details:
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
GitHub Security Advisory: GHSA-5ghq-28r7-qwfj
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 3.6.5
Patched in: 3.6.5

Summary: Mattermost Server does not restrict SAML certificate path for System Administrators

Details:
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
GitHub Security Advisory: GHSA-jxc4-w54c-qv5r
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-328: Use of Weak Hash
Vulnerable versions: >= 3.8.0, < 3.8.2
Patched in: 3.8.2

Summary: Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

Details:
An issue was discovered in Mattermost Server before 3.8.2 and 3.7.5. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
GitHub Security Advisory: GHSA-jxc4-w54c-qv5r
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-328: Use of Weak Hash
Vulnerable versions: < 3.7.5-0[PII_REDACTED]2444-247cd1e51a8c
Patched in: 3.7.5-0[PII_REDACTED]2444-247cd1e51a8c

Summary: Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

Details:
An issue was discovered in Mattermost Server before 3.8.2 and 3.7.5. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
GitHub Security Advisory: GHSA-x33g-375j-jhf7
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.8.0, < 3.8.2
Patched in: 3.8.2

Summary: Mattermost Server has Improper Authorization for Integration Requests

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
GitHub Security Advisory: GHSA-x33g-375j-jhf7
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.7.0, < 3.7.5
Patched in: 3.7.5

Summary: Mattermost Server has Improper Authorization for Integration Requests

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
GitHub Security Advisory: GHSA-x33g-375j-jhf7
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 3.6.7-0[PII_REDACTED]2529-0968e4079e0a
Patched in: 3.6.7-0[PII_REDACTED]2529-0968e4079e0a

Summary: Mattermost Server has Improper Authorization for Integration Requests

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
GitHub Security Advisory: GHSA-hxxj-8phw-74vw
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: >= 3.8.0, < 3.8.2
Patched in: 3.8.2

Summary: Mattermost Server server restarts may provide attackers with API access

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
GitHub Security Advisory: GHSA-hxxj-8phw-74vw
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: >= 3.7.0, < 3.7.5
Patched in: 3.7.5

Summary: Mattermost Server server restarts may provide attackers with API access

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
GitHub Security Advisory: GHSA-hxxj-8phw-74vw
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: < 3.6.7-0[PII_REDACTED]2529-0968e4079e0a
Patched in: 3.6.7-0[PII_REDACTED]2529-0968e4079e0a

Summary: Mattermost Server server restarts may provide attackers with API access

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
GitHub Security Advisory: GHSA-m462-mqw4-2c8m
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.8.0, < 3.8.2
Patched in: 3.8.2

Summary: Mattermost Server has X.509 Improper Certificate Validation

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
GitHub Security Advisory: GHSA-m462-mqw4-2c8m
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.7.0, < 3.7.5
Patched in: 3.7.5

Summary: Mattermost Server has X.509 Improper Certificate Validation

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
GitHub Security Advisory: GHSA-m462-mqw4-2c8m
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 3.6.7-rc1
Patched in: 3.6.7-rc1

Summary: Mattermost Server has X.509 Improper Certificate Validation

Details:
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
GitHub Security Advisory: GHSA-wxrw-gvg8-fqjp
Package: github.com/bishopfox/sliver (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 1.6.11
Patched in: 1.6.12

Summary: Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service

Details:
## Summary
The DNS C2 listener accepts unauthenticated `TOTP` bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when `EnforceOTP` is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.

## Vulnerable Component
- `server/c2/dns.go:84-90` (`EnforceOTP` stored but not enforced in bootstrap)
- `server/c2/dns.go:378-390` (`TOTP` requests routed directly to bootstrap)
- `server/c2/dns.go:490-521` (`handleHello` allocates session without OTP validation)
- `server/c2/dns.go:495` (`sessions.Store` with no lifecycle control in this path)
- `client/command/jobs/dns.go:46-52` (operator-facing `EnforceOTP` control implies auth gate)
- `implant/sliver/transports/dnsclient/dnsclient.go:896-900` (`otpMsg` sends `TOTP` with `ID=0`)
- `protobuf/dnspb/dns.proto:22` (documents TOTP in `ID` field)

## Attack Vector
- Network-accessible DNS listener
- No authentication required
- Low-complexity repeated DNS query loop
- Trigger path: `DNSMessageType_TOTP` bootstrap handling

## Proof of Concept
### Preconditions
- DNS listener is reachable
- DNS C2 job is active

### Reproduction Steps
1. Send repeated DNS queries with a minimal protobuf message of type `TOTP`.
2. Observe repeated session allocation/issuance behavior.
3. Continue requests to increase active in-memory session state.

### Example
```bash
while true; do
  dig +short @<DNS_C2_IP> baa8.<parent-domain> A >/dev/null
done
```

`baa8` is a base32 payload for a minimal TOTP-type protobuf message.

### Observable Indicators
- Repeated bootstrap/session-allocation log entries from `handleHello`
- Rising memory usage in the Sliver server process
- Service slowdown or instability under sustained request volume

## Impact
- Unauthenticated remote denial of service (availability)
- Resource exhaustion through unbounded session growth in DNS bootstrap path
- Estimated CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (**7.5 High**)
GitHub Security Advisory: GHSA-42x9-rr3c-gr59
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.10.0, < 3.10.2
Patched in: 3.10.2

Summary: Mattermost Server vulnerable to XSS through channel headers

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
GitHub Security Advisory: GHSA-42x9-rr3c-gr59
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.9.2-0[PII_REDACTED]4920-312269ad0bd1
Patched in: 3.9.2-0[PII_REDACTED]4920-312269ad0bd1

Summary: Mattermost Server vulnerable to XSS through channel headers

Details:
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
GitHub Security Advisory: GHSA-86x4-wp9f-wrr9
Package: antrea.io/antrea (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.4.0, < 2.4.3
Patched in: 2.4.3

Summary: Antrea has invalid enforcement order for network policy rules caused by integer overflow

Details:
### Impact

Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement.

If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks.

The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot take precedence over rules defined in higher priority Tiers. Some users / roles may only be authorized to define within specific Tiers. This security vulnerability enables such users to intentionally "escape" their Tier and override rules in higher priority Tiers.

Antrea deployments that *only* use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

### Patches
https://github.com/antrea-io/antrea/pull/7496
Antrea v2.5.0
Antrea v2.4.3
Antrea v2.3.2

### Workarounds

Antrea deployments that *only* use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

For users leveraging Antrea NetworkPolicies, there is no way to fix or remediate the vulnerability without upgrading.

### Resources

https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9
https://github.com/antrea-io/antrea/pull/7496
https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md
GitHub Security Advisory: GHSA-86x4-wp9f-wrr9
Package: antrea.io/antrea (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.3.2
Patched in: 2.3.2

Summary: Antrea has invalid enforcement order for network policy rules caused by integer overflow

Details:
### Impact

Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement.

If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks.

The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot take precedence over rules defined in higher priority Tiers. Some users / roles may only be authorized to define within specific Tiers. This security vulnerability enables such users to intentionally "escape" their Tier and override rules in higher priority Tiers.

Antrea deployments that *only* use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

### Patches
https://github.com/antrea-io/antrea/pull/7496
Antrea v2.5.0
Antrea v2.4.3
Antrea v2.3.2

### Workarounds

Antrea deployments that *only* use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.

For users leveraging Antrea NetworkPolicies, there is no way to fix or remediate the vulnerability without upgrading.

### Resources

https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9
https://github.com/antrea-io/antrea/pull/7496
https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md
GitHub Security Advisory: GHSA-vhvq-fv9f-wh4q
Package: github.com/authzed/spicedb (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 1.29.3, < 1.49.1
Patched in: 1.49.1

Summary: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

Details:
## Description
A malformed or tampered-with LookupResources [Cursor token](https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.Cursor) can cause a panic in the SpiceDB process if it fails to parse. If an attacker were able to make requests to a SpiceDB instance, they could affect its availability.

## Reproduction
If one was to take a cursor from a LookupResources call, decode it according to the logic that SpiceDB uses, and modify the Sections field to include an invalid relationship string, the process will panic.

## Impact
An attacker would need both the ability to create a gRPC connection to your SpiceDB instance and a valid token, or else the ability to pass a cursor token from outside your application through to your SpiceDB instance.

If an attacker had this ability, they could bring down SpiceDB instances, reducing the availability of SpiceDB and any service that depends on it.

## Mechanism
The SpiceDB process does not validate the contents of this `Sections` component of the `Cursor` message. In affected versions, it uses a parsing function that calls `panic` if the value cannot be parsed as a relationship. 

## Fix
This issue was fixed in https://github.com/authzed/spicedb/pull/2878.

## Remediations
* Prevent client control of the `optional_cursor` field in `LookupResources` calls
* Upgrade to an unaffected version