huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-55752: tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
Component: tomcat
Severity: Important
CWE: CWE-23 (Relative Path Traversal)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-27T17:29:56.060000+00:00

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If HTTP PUT requests are also enabled, this flaw could allow the upload of malicious files, potentially leading to remote code execution.

Statement: This vulnerability is rated as Important rather than Critical because successful exploitation depends on specific, non-default configuration conditions. The flaw only becomes exploitable when both URL rewriting rules that modify the request path are in use and HTTP PUT requests are enabled — a feature typically restricted to administrative or trusted users. In standard Tomcat deployments, PUT is disabled or tightly controlled, and rewrite configurations rarely expose sensitive paths. Therefore, while the issue could theoretically lead to remote code execution, the limited attack surface and requirement for uncommon setup conditions significantly reduce its overall risk level.

Affected upstream versions: 11.0.0-M1 <= 11.0.10, 10.1.0-M1 <= 10.1.44, 9.0.0.M11 <= 9.0.108, 8.5.6 <= 8.5.100
Fixed upstream versions: 11.0.11
Upstream repository: https://github.com/apache/tomcat
Upstream fix commit: fec06c610ed7466b401e29cc567a58aee5ed826a
CVE-2025-55754: org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation
Component: org.apache.tomcat/tomcat-juli
Severity: Moderate
CWE: CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences)
CVSS v3: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
Public date: 2025-10-27T17:29:50.756000+00:00

An improper input neutralization flaw has been discovered in Apache Tomcat. 
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.


Affected upstream versions: 11.0.0-M1 <= 11.0.10, 10.1.0-M1 <= 10.1.44, 9.0.40 <= 9.0.108, 8.5.60 <= 8.5.100
Fixed upstream versions: 11.0.11
Upstream repository: https://github.com/apache/tomcat
Upstream fix commit: 5a3db092982c0c58d4855304167ee757fe5e79bb
CVE-2025-57803: imagemagick: ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
Component: imagemagick
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-08-26T17:25:59.148000+00:00

A flaw was found in ImageMagick. In 32-bit builds, the Bitmap encoder miscalculates the stride value when processing images with very large with. Mathematically, the stride value is calculated as width multiplied by 3 but the theoretical limit of such value is 2^32 for 32-bit integers. So, if this value is exceeded, the encoder uses modulo to convert it down and then takes the smaller value as the actual stride length. This is problematic because the pixel data starts to overlap when being added to the buffer due to the small stride value messing up the rows. This heap buffer overflow allows an attacker to cause a denial of service or, with crafted input, potentially execute arbitrary code.

Statement: This vulnerability is specific to 32-bit ImageMagick builds. Red Hat predominantly only ships 64-bit builds of Kea on its platforms and so the vulnerability affects only customers that install i686 arch rpm packages as these are the only 32-bit builds Red Hat provides. The flaw occurs in the WriteBMPImage function when computing bytes_per_line for 24-bpp BMP images. An integer overflow causes the stride to underflow to a small value, while the writer still emits 3 × width bytes per row. The mismatch immediately produces a large, attacker-controlled heap overwrite.

Affected upstream versions: < 7.1.2-2, < 6.9.13-28
Fixed upstream versions: 7.1.2-2
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 2c55221f4d38193adcb51056c14cf238fbcc35d7
CVE-2025-57809: xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars
Component: xgrammar
Severity: Important
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-08-25T21:22:00.226000+00:00

A flaw was found in xgrammar. Recursive grammar definitions could trigger infinite recursion during parsing in GrammarMatcherBase::ExpandEquivalentStackElements, leading to unbounded stack growth and a segmentation fault. This vulnerability allows remote attackers to cause a denial of service (DoS) when untrusted grammar is processed.

Statement: This vulnerability is considered Important because it can be exploited remotely, without authentication or user interaction, and directly impacts the availability of systems that rely on xgrammar for structured output parsing. Unlike a Moderate flaw that might require unusual conditions or only cause partial degradation, the infinite recursion issue reliably leads to process termination or complete resource exhaustion when malicious input is supplied. Since xgrammar is often integrated into long-running LLM inference services or API backends, a single crafted grammar can consistently force these services into a denial-of-service state, making it a practical, high-impact attack vector. While it does not compromise confidentiality or integrity, the ease of exploitation, network accessibility, and total loss of availability elevate it from a moderate to an important security issue.

Affected upstream versions: < 0.1.21
Fixed upstream versions: v0.1.21
Upstream repository: https://github.com/mlc-ai/xgrammar
Upstream fix commit: b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5
CVE-2025-57810: jspdf: jsPDF Denial of Service (DoS)
Component: jspdf
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-08-26T15:37:28.071000+00:00

An excessive resource consumption flaw has been discovered in the jsPDF npm library. Passing a maliciously crafted PNG file to the library may result in high CPU usage and a denial of service of the program the library is being used in.

Statement: The availability impact of this flaw is limited on Red Hat systems as the host operating system is not at risk of degradation.

Affected upstream versions: < 3.0.2
Fixed upstream versions: v3.0.2
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 4cf3ab619e565d9b88b4b130bff901b91d8688e9
CVE-2025-57812: cups: CUPS-Filters: Information disclosure and data corruption via crafted TIFF image file processing
Component: cups
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 3.7 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-11-12T18:46:52.801000+00:00

A flaw was found in CUPS-Filters, including `libcupsfilters`. An attacker on the same local network, with low privileges, could exploit an out-of-bounds read/write vulnerability by submitting a specially crafted TIFF image file as a print job with specific options. This could lead to limited information disclosure and data corruption.


Affected upstream versions: cups-filters <= 1.28.17, libcupsfilters >= 2.0.0, < 2.1.1
Upstream repository: https://github.com/OpenPrinting/libcupsfilters
Upstream fix commit: b69dfacec7f176281782e2f7ac44f04bf9633cfa
CVE-2025-58056: netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Component: netty-codec-http
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2025-09-03T20:56:50.732000+00:00

A flaw in Netty’s HTTP/1.1 chunked encoding parser allows newline (LF) characters in chunk extensions to be incorrectly treated as the end of the chunk-size line instead of requiring the proper CRLF sequence. This discrepancy can be exploited in rare cases where a reverse proxy interprets the same input differently, potentially enabling HTTP request smuggling attacks such as bypassing access controls or corrupting responses.

Statement: This issue is considered Moderate rather than Important because successful exploitation depends on a very specific deployment condition: the presence of an intermediary reverse proxy that both mishandles lone LF characters in chunk extensions and forwards them unmodified to Netty. By itself, Netty’s parsing quirk does not introduce risk, and in most real-world environments, reverse proxies normalize or reject malformed chunked requests, preventing smuggling. As a result, the vulnerability has limited reach, requires a niche configuration to be exploitable, and does not universally expose Netty-based servers to request smuggling—hence it is rated moderate in severity rather than important or critical.

Affected upstream versions: >= 4.2.0.Alpha3, < 4.2.5.Final, <= 4.1.124.Final, < 4.1.125.Final
Fixed upstream versions: netty-4.2.5.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: edb55fd8e0a3bcbd85881e423464f585183d1284
CVE-2025-58057: netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Component: netty-codec
Severity: Moderate
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-03T21:46:49.928000+00:00

A flaw was found in Netty. With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service.

Statement: This vulnerability is rated Moderate for Red Hat products. A flaw in Netty's BrotliDecoder and other decompression decoders can lead to a denial of service when processing specially crafted input. This affects various Red Hat products that utilize Netty for network communication and data decompression. Using BrotliDecoder on untrusted input is entirely

Affected upstream versions: <= 4.1.124.Final, < 4.1.125.Final, <= 4.2.4.Final,  < 4.2.5.Final
Fixed upstream versions: netty-4.2.5.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 9d804c54ce962408ae6418255a83a13924f7145d
CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory
Component: github.com/ulikunitz/xz
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-08-28T21:54:05.561000+00:00

A memory leak flaw has been discovered in the golang github.com/ulikunitz/xz package. In affected versions, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done.


Affected upstream versions: < 0.5.14
Fixed upstream versions: v0.5.14
Upstream repository: https://github.com/ulikunitz/xz
Upstream fix commit: 88ddf1d0d98d688db65de034f48960b2760d2ae2
CVE-2025-58060: cups: Authentication Bypass in CUPS Authorization Handling
Component: cups
Severity: Important
CWE: CWE-287 (Improper Authentication)
CVSS v3: 8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-11T13:00:00+00:00

A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize() function, the password is not checked. This vulnerability allows attackers to bypass authentication entirely, resulting in unauthorized access to administrative functions and system configuration.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it enables complete authentication bypass. Exploitation requires no valid credentials and can be performed remotely in some configurations. Attackers could gain administrative privileges in CUPS, modify critical configuration files, or potentially escalate their access further depending on the system environment. The root cause is a missing authentication check when the AuthType is set to values other than Basic but a Basic authorization header is supplied.

Affected upstream versions: < 2.4.13
Fixed upstream versions: v2.4.13
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: 595d691075b1d396d2edfaa0a8fd0873a0a1f221
CVE-2025-58068: python-eventlet: Eventlet HTTP request smuggling
Component: python-eventlet
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-08-29T21:12:24.534000+00:00

A request smuggling flaw was found in the Eventlet PyPI library. The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability allows attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.


Affected upstream versions: < 0.40.3
Fixed upstream versions: 0.40.3
Upstream repository: https://github.com/eventlet/eventlet
Upstream fix commit: 0bfebd1117d392559e25b4bfbfcc941754de88fb
CVE-2025-58185: encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1
Component: encoding/asn1
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-29T22:10:13.682000+00:00

A memory exhaustion flaw has been discovered in the golang encoding/asn1 module. Within parseSequenceOf, reflect.MakeSlice is being used to pre-allocate a slice that is needed in order to fully validate the given DER payload. The size of the slice allocated are also multiple times larger than the input DER. As a result, a malicious actor can craft a big empty DER payload, resulting in an unnecessary large allocation of memories. This can be a way to cause memory exhaustion.


Affected upstream versions: 1.25.0 < 1.25.2
Fixed upstream versions: 1.24.8, 1.25.2
Upstream repository: https://github.com/golang/go
Upstream fix commit: 8709a41d5ef7321f486a1857f189c3fee20e8edd
CVE-2025-58187: crypto/x509: Quadratic complexity when checking name constraints in crypto/x509
Component: crypto/x509
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-29T22:10:12.624000+00:00

A potential denial of service flaw has been discovered in golang's crypto/x509 module. Due to the design of the name constraint checking algorithm, the processing time of some inputs scales non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.


Affected upstream versions: 1.25.0 < 1.25.3
Fixed upstream versions: 1.24.9, 1.25.3
Upstream repository: https://github.com/golang/go
Upstream fix commit: 3fc4c79fdbb17b9b29ea9f8c29dd780df075d4c4
CVE-2025-58188: crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509
Component: crypto/x509
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-29T22:10:14.143000+00:00

A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint that verifies the certificate chain.

Statement: Availability impacts are limited on Red Hat products as they do not affect the host systems.

Affected upstream versions: 1.25.0 < 1.25.2
Fixed upstream versions: 1.24.8, 1.25.2
Upstream repository: https://github.com/golang/go
Upstream fix commit: 6e4007e8cffbb870e6b606307ab7308236ecefb9
CVE-2025-58364: cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
Component: cups
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-11T13:00:00+00:00

A flaw was found in the CUPS printing system’s ipp_read_io() function, which handles Internet Printing Protocol (IPP) requests. When processing specially crafted printer attribute responses, improper validation can cause a null pointer dereference. This leads to a crash in libcups, potentially disrupting printing services. Since CUPS is widely deployed on Linux systems for printer discovery and management, this issue can cause denial-of-service (DoS) across multiple machines on a local network.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate . The flaw can be remotely exploited within local subnets to crash CUPS services without requiring authentication or user interaction. In cases where machines expose IPP services to the internet, the vulnerability may be exploitable over the network. The root cause is improper deserialization and validation of printer attributes in the ipp_read_io() function, leading to null pointer dereference and denial-of-service.

Affected upstream versions: < 2.4.13
Fixed upstream versions: v2.4.13
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: e58cba9d6fceed4242980e51dbd1302cf638ab1d
CVE-2025-58436: cups: Slow client communication leads to a possible DoS attack
Component: cups
Severity: Moderate
CWE: CWE-412 (Unrestricted Externally Accessible Lock)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-01T00:00:00+00:00

A flaw was found in cups. A client that connects to cupsd but sends slow messages, e.g. only one  byte per second, delays cupsd as a whole, such that it becomes unusable 
by other clients.


Affected upstream versions: < 2.4.15
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: 40008d76a001babbb9beb9d9d74b01a86fb6ddb4
CVE-2025-58754: axios: Axios DoS via lack of data size check
Component: axios
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-09-12T01:16:40.513000+00:00

A denial of service flaw has been discovered in the Axios npm package. When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Statement: Availability impact is limited to the application which bundles axios and not the host Red Hat system.

Affected upstream versions: >= 1.0.0, < 1.12.0, >= 0.28.0, < 0.30.2
Fixed upstream versions: v1.12.0
Upstream repository: https://github.com/axios/axios
Upstream fix commit: 945435fc51467303768202250debb8d4ae892593
CVE-2025-58767: rexml: REXML denial of service
Component: rexml
Severity: Moderate
CWE: CWE-776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-09-17T17:45:58.118000+00:00

A denial of service flaw has been discovered in the rubygem REXML. Certain input can cause excess cpu usage and given sufficiently large input this can affect program performance.

Statement: Red Hat Product Security team has rated this vulnerability as having the 'Moderate' severity, with the final CVSSv3.1 score of 5.3 as the final impact in availability is restricted to the application consuming the REXML package and not the whole system.

Affected upstream versions: >= 3.3.3, < 3.4.2
Fixed upstream versions: v3.4.2
Upstream repository: https://github.com/ruby/rexml
Upstream fix commit: 5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23
CVE-2025-5889: brace-expansion: juliangruber brace-expansion index.js expand redos
Component: brace-expansion
Severity: Low
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-06-09T18:16:01.889000+00:00

A denial-of-service (DoS) vulnerability has been identified in the brace-expansion JavaScript package. This issue occurs due to inefficient regular expression complexity, which can be exploited by an attacker providing specially crafted input. Such input could lead to excessive processing time and resource consumption, rendering applications that utilize this package unresponsive and causing a denial-of-service condition.


Affected upstream versions: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 2.0.0, 2.0.1, 3.0, 4.0
Fixed upstream versions: 1.1.12, 2.0.2, 3.0.1, 4.0.1
Upstream repository: https://github.com/juliangruber/brace-expansion
Upstream fix commit: a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
CVE-2025-59089: python-kdcproxy: Remote DoS via unbounded TCP upstream buffering
Component: python-kdcproxy
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-11-12T00:00:00+00:00

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new
buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response
header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.


Affected upstream versions: <= v1.0.0
Fixed upstream versions: 0:0.3.2-3.el7_9.3, 0:1.0.0-19.el10_0, 0:1.0.0-19.el10_1, 0:1.0.0-7.el9_0.1, 0:1.0.0-7.el9_2.1, 0:1.0.0-7.el9_4.1, 0:1.0.0-9.el9_6, 0:1.0.0-9.el9_7, 1.1.0, 8020020251106022345.792f4060, 8040020251103205102.5b01ab7e, 8060020251030180424.ada582f1, 8080020251029082621.b0a6ceea, 8100020251028161822.823393f5, 8100020251103113748.143e9e98
Upstream repository: https://github.com/latchset/kdcproxy
Upstream fix commit: c7675365aa20be11f03247966336c7613cac84e1