rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-54534 
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Published: 2025-07-28T16:20:44.842Z
CVE-2025-54535 
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
Problem types: cwe_id: CWE-328
description: CWE-328
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2025-07-28T16:20:45.628Z
CVE-2025-54536 
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published: 2025-07-28T16:20:46.257Z
CVE-2025-54537 
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2025-07-28T16:20:46.792Z
CVE-2025-54538 
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2025-07-28T16:20:47.459Z
CVE-2025-54539 Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.

This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side.

Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions.

In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases.

Mitigation and Recommendations:
Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ NMS AMQP Client
default_status: unaffected
Credits: lang: en
value: Security Research Team @ Endor Labs
Published: 2025-10-16T08:26:06.766Z
CVE-2025-54540 Reflected XSS in QuickCMS
QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: OpenSolution
product: QuickCMS
default_status: unknown
Credits: lang: en
value: Karol Czubernat
Published: 2025-08-28T10:12:29.653Z
CVE-2025-54541 Cross-Site Request Forgery in QuickCMS
QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: OpenSolution
product: QuickCMS
default_status: unknown
Credits: lang: en
value: Karol Czubernat
Published: 2025-08-28T10:12:31.827Z
CVE-2025-54542 Sending Password in GET Request
QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Problem types: cwe_id: CWE-598
description: CWE-598 Use of GET Request Method With Sensitive Query Strings
Affected products: vendor: OpenSolution
product: QuickCMS
default_status: unknown
Credits: lang: en
value: Karol Czubernat
Published: 2025-08-28T10:12:38.118Z
CVE-2025-54543 Stored XSS in QuickCMS
QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: OpenSolution
product: QuickCMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-08-28T10:12:40.384Z
CVE-2025-54544 Stored XSS in QuickCMS
QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: OpenSolution
product: QuickCMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-08-28T10:12:42.041Z
CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Arista Networks
product: DANZ Monitoring Fabric
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-29T22:36:24.379Z
CVE-2025-54546 On affected platforms, restricted users could use SSH port forwarding to access host-internal services
On affected platforms, restricted users could use SSH port forwarding to access host-internal services
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Arista Networks
product: DANZ Monitoring Fabric
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-29T22:40:57.833Z
CVE-2025-54547 On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: Arista Networks
product: DANZ Monitoring Fabric
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-10-29T22:45:53.499Z
CVE-2025-54548 On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Arista Networks
product: DANZ Monitoring Fabric
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-10-29T22:52:54.039Z
CVE-2025-54549 Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO
Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Arista Networks
product: DANZ Monitoring Fabric
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-10-29T22:55:54.433Z
CVE-2025-54550 Apache Airflow: RCE by race condition in example_xcom dag
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value
from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary
execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.

It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however
users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of
the example with improved resiliance for that case.

Users who followed that pattern are advised to adjust their implementations accordingly.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Vincent55 Yang
Published: 2026-04-15T00:22:03.305Z
CVE-2025-54551 
Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not have permission to view by altering the parameters of the search function.
Problem types: cwe_id: CWE-472
description: External control of assumed-Immutable web parameter
Affected products: vendor: FUJIFILM Healthcare Americas Corporation
product: Synapse Mobility
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: 2025-08-20T04:57:37.466Z
CVE-2025-54554 
tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Tera Insights
product: tiCrypt
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2025-08-04T00:00:00.000Z
CVE-2025-54558 
OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: OpenAI
product: Codex CLI
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2025-07-25T00:00:00.000Z
CVE-2025-54559 
An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-14T00:00:00.000Z
CVE-2025-54560 
A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-14T00:00:00.000Z
CVE-2025-54561 
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-14T00:00:00.000Z
CVE-2025-54562 
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed through stack trace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-14T00:00:00.000Z
CVE-2025-54563 
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-24T00:00:00.000Z
CVE-2025-54564 
uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-01T00:00:00.000Z
CVE-2025-54566 
hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.
Problem types: cwe_id: CWE-642
description: CWE-642 External Control of Critical State Data
Affected products: vendor: QEMU
product: QEMU
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-07-25T00:00:00.000Z
CVE-2025-54567 
hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.
Problem types: cwe_id: CWE-684
description: CWE-684 Incorrect Provision of Specified Functionality
Affected products: vendor: QEMU
product: QEMU
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-07-25T00:00:00.000Z
CVE-2025-54568 
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.
Problem types: cwe_id: CWE-684
description: CWE-684 Incorrect Provision of Specified Functionality
Affected products: vendor: Akamai
product: Rate Control
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-07-25T00:00:00.000Z
CVE-2025-54569 
In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Malwarebytes
product: Binisoft Windows Firewall Control
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-07-28T00:00:00.000Z
CVE-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11
and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Problem types: cwe_id: CWE-252
description: CWE-252: Unchecked Return Value
Affected products: vendor: owasp-modsecurity
product: ModSecurity
Published: 2025-08-05T23:39:40.712Z
CVE-2025-54572 Ruby SAML DOS vulnerability with large SAML response
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: SAML-Toolkits
product: ruby-saml
Published: 2025-07-30T14:05:43.820Z
CVE-2025-54573 CVAT vulnerable to email verification bypass by use of basic authentication
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the missing email verification check leaves the system open to bot signups and further usage. CVAT 2.42.0 and later versions contain a fix for the issue. CVAT Enterprise customers have a workaround available; those customers may disable registration to prevent this issue.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: cvat-ai
product: cvat
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-07-30T14:32:03.675Z
CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: squid-cache
product: squid
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
version: 3.1
Published: 2025-08-01T18:02:19.117Z
CVE-2025-54575 ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks
ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: SixLabors
product: ImageSharp
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-07-30T19:55:16.248Z