rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-47174 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-06-10T17:02:42.742Z
CVE-2025-47175 Microsoft PowerPoint Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Microsoft PowerPoint 2016
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-06-10T17:02:43.236Z
CVE-2025-47176 Microsoft Outlook Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal: '.../...//'
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-06-10T17:02:43.887Z
CVE-2025-47178 Microsoft Configuration Manager Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Microsoft
product: Microsoft Configuration Manager
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-07-08T16:57:25.690Z
CVE-2025-47179 Configuration Manager Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Microsoft
product: Microsoft Configuration Manager
vendor: Microsoft
product: Microsoft Configuration Manager 2409
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:34.472Z
CVE-2025-47181 Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based) Updater
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-22T22:03:30.053Z
CVE-2025-47182 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.6
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C
Published: 2025-07-11T16:36:53.521Z
CVE-2025-47183 
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-07T00:00:00.000Z
CVE-2025-47184 
An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-47187 
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to perform a file upload attack due to missing authentication mechanisms. A successful exploit could allow an attacker to upload arbitrary WAV files, which may potentially exhaust the phone’s storage without affecting the phone's availability or operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-23T00:00:00.000Z
CVE-2025-47188 
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-07T00:00:00.000Z
CVE-2025-47189 
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user flows, a different vulnerability than CVE-2025-54392.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-17T00:00:00.000Z
CVE-2025-47201 
In Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aka XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Intrexx
product: Portal Server
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Published: 2025-05-02T00:00:00.000Z
CVE-2025-47202 
In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400, the lack of a length check leads to out-of-bounds writes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-47203 
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dropbear SSH Project
product: Dropbear SSH
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-07T00:00:00.000Z
CVE-2025-47204 
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-47205 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.8.3332 build 20251128 and later
QuTS hero h5.2.8.3321 build 20251117 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:44.097Z
CVE-2025-47206 File Station 5
An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4933 and later
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-08-18T08:27:55.068Z
CVE-2025-47207 File Station 5
A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5018 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-11-07T15:16:08.604Z
CVE-2025-47208 QTS, QuTS hero
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-01-02T14:52:49.669Z
CVE-2025-47209 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:38.978Z
CVE-2025-47210 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:58.401Z
CVE-2025-47211 QTS, QuTS hero
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:04.837Z
CVE-2025-47212 QTS, QuTS hero
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: Yuze Wu(h1J4cker)
Published: 2025-10-03T18:10:11.466Z
CVE-2025-47213 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:17.500Z
CVE-2025-47214 QTS
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
  and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:26.403Z
CVE-2025-47219 
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-07T00:00:00.000Z
CVE-2025-47220 
A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized image format, it will return this as an error to the clientside, confirming the existences of the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-13T00:00:00.000Z
CVE-2025-47221 
An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-13T00:00:00.000Z
CVE-2025-47222 
A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information about the classes loaded in the application or not to the clientside.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-13T00:00:00.000Z
CVE-2025-47226 
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request ('Forced Browsing')
Affected products: vendor: snipeitapp
product: Snipe-IT
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-05-02T00:00:00.000Z
CVE-2025-47227 
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
Problem types: cwe_id: CWE-684
description: CWE-684 Incorrect Provision of Specified Functionality
Affected products: vendor: ScriptCase
product: ScriptCase
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: 2025-07-05T00:00:00.000Z
CVE-2025-47228 
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: ScriptCase
product: ScriptCase
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Published: 2025-07-05T00:00:00.000Z
CVE-2025-47229 
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: GNU
product: PSPP
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.9
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-05-03T00:00:00.000Z
CVE-2025-47241 
In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
Problem types: cwe_id: CWE-647
description: CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
Affected products: vendor: browser-use
product: browser-use
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-05-03T00:00:00.000Z
CVE-2025-47244 
Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Inedo
product: ProGet
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: 2025-05-03T00:00:00.000Z
CVE-2025-47245 
In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: BlueWave
product: Checkmate
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-05-03T00:00:00.000Z
CVE-2025-47256 
Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Libxmp
product: Libxmp
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Published: 2025-05-06T00:00:00.000Z
CVE-2025-47268 
ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: iputils
product: iputils
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-05-05T00:00:00.000Z
CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL
code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL `https://<code-server>/proxy/test@evil.com/path` would be proxied to `test@evil.com/path` where the attacker could exfiltrate a user's session token. Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy. Normally this is used to proxy local ports, however the URL can reference the attacker's domain instead, and the connection is then proxied to that domain, which will include sending cookies. With access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server. This issue has been patched in version 4.99.4.
Problem types: cwe_id: CWE-441
description: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Affected products: vendor: coder
product: code-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2025-05-09T20:59:01.510Z
CVE-2025-47270 nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service (DoS) attack due to uncontrolled memory allocation. Specifically, the implementation of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enforcing an upper bound. Since this length is a `u32`, a peer can trigger allocations of up to 4 GB, potentially leading to memory exhaustion and node crashes. As Discovery messages are regularly exchanged for peer discovery, this vulnerability can be exploited repeatedly. The patch for this vulnerability is formally released as part of v1.1.0. The patch implements a limit to the discovery message size of 1 MB and also resizes the message buffer size incrementally as the data is read. No known workarounds are available.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: nimiq
product: core-rs-albatross
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-05-12T10:47:44.804Z