Slipping an extra request through Cloudflare Pingora on a close-delimited body

Pingora could not recognise a comma-separated Transfer-Encoding, so it read the request body until the socket closed.

found by Rajat Raghav (xclow3n)

Same digest, different files: ZIP parser differentials in uv and pip

A ZIP with one digest that expands into two different packages depending on which installer opens it.

found by Caleb Brown (Google) and Tim Hatch (Netflix)

Overflowing the DjVuLibre MMR decoder with zero-length runs

A fax-coding decoder writes one run-length entry per code and never checks it is still inside the buffer.

found by Antonio Morales, GitHub Security Lab

A request header made Next.js cache private per-user responses

One internal header flips an SSR response into an SSG one, and the Cache-Control header follows it.

found by Allam Rachid (zhero_) and Henry Chen

Escaping a root directory with Windows device paths in Go's path/filepath

Go's path cleaner did not know that \??\c:\x is another spelling of c:\x, and the fix for that needed a fix of its own.

Out-of-bounds write in libcue from a negative INDEX number

atoi has no way to report failure, and track_set_index only checked one end of the array.

found by Kevin Backhouse, GitHub Security Lab

What does the Squid request smuggling patch actually fix?

The advisory says 'chunked decoder lenience' and stops; the commit says 0x prefixes, bare LFs and a bad rewind point.

found by Keran Mu and Jianjun Chen, Tsinghua University

Type confusion in OpenSSL's X.400 address handling (CVE-2023-0286)

A public header said ASN1_TYPE, the ASN.1 template produced an ASN1_STRING, and one comparison function stood between the two.

found by David Benjamin (Google); fix by Hugo Landau

Traversing a path into the Home Assistant Supervisor API without a token

An unauthenticated allow-list matched a string while a proxy client normalised a path, three times in a row.

found by Joseph Surin and Victor Kahan, elttam

A second root element: SAML signature bypass in passport-saml

An XML signature covers an element, not a file, and passport-saml picked its element two different ways.

found by Felix Wilhelm, Google Project Zero

Non-responsive delegation: CPU exhaustion in Unbound and BIND 9 resolvers

The referral cap everyone added after NXNSAttack turns into a loop when the nameservers exist but never answer.

found by Yehuda Afek, Anat Bremler-Barr and Shani Stajnrod

Pointing Cargo's .cargo-ok write at a file outside the crate directory

Cargo wrote "ok" into a marker file after unpacking a crate, and the crate got to decide what that marker was.

found by Ori Hollander, JFrog Security Research

Turning a 27-byte IP fragment into an arbitrary write in U-Boot

U-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.

found by Nicolas Guigo and Nicolas Bidron, NCC Group

Proof of nothing: TLS 1.3 authentication bypasses in wolfSSL

How a black-box state machine learner found two ways to skip the only part of TLS 1.3 that proves who you are.

found by Aina Toky Rasoamanana and Olivier Levillain, Télécom SudParis

Space in a token: request smuggling in mitmproxy's HTTP/1.1 parser

mitmproxy split header lines on the first colon and kept whatever came before it, whitespace included.

found by Zeyu Zhang (zeyu2001)

Namespace separator injection in libexpat (CVE-2022-25236)

libexpat packed three strings into one buffer with a delimiter you chose, and never checked whether the delimiter turned up in the data.

found by Ivan Fratric, Google Project Zero

Last write wins: an ext_authz authorization bypass in Envoy

Envoy packed request headers for its external authorizer into a protobuf map, so a repeated header arrived with only its last value.

Reflected public keys: recovering the six digits of Bluetooth Passkey Entry

Bluetooth Passkey Entry spends a bit of the passkey per round so it can never be brute-forced offline. Reflect the initiator's public key back at it and it hands over one bit per round instead.

found by Tristan Claverie and José Lopes Esteves, ANSSI

Arbitrary file write in node-tar through a stale directory cache

node-tar skipped a symlink check whenever its directory cache said the path was fine, and two ways of spelling a path could make the cache lie.

found by chen-robert, ginkoid and levpachmanov

Running commands from RDoc by starting a filename with a pipe

RDoc sniffed the first hundred bytes of any file called 'tags' to see whether it was a ctags index, and used the one Ruby function that treats a leading pipe as a command.

found by Alexandr Savca

Python's parse_qsl treated semicolons as separators, enabling web cache poisoning

A standard-library parser that separated parameters on ';' as well as '&', and the cache poisoning that followed when the proxy in front disagreed.

found by Adam Goldschmidt (Snyk)

A fifth length byte: integer overflow and a signed syscall compare in Zephyr RTOS

A greater-than that should have been a greater-than-or-equal lets a remote MQTT packet pick any 32-bit length it likes, and a signed branch instruction lets a user thread pick any function pointer it…

found by Ilya Zhuravlev and Jeremy Boone, NCC Group

Half-blind: SSRF in Kubernetes dynamic provisioning via StorageClass parameters

kube-controller-manager will connect to any address you write into a StorageClass, and until 2020 it read the response back to you in a PersistentVolumeClaim event.

found by Brice Augras (Groupe-Asten) and Christophe Hauquiert (Nokia)

Smuggling requests past HAProxy with a vertical tab in Transfer-Encoding

How a vertical tab in a Transfer-Encoding header made HAProxy and its backend disagree about where a request ended, opening an HTTP request smuggle.

found by Nathan Davison (independent)

Who asked for this file? Previous mode confusion in Windows kernel drivers

Windows stores one previous-access-mode value per thread and uses it to answer two unrelated questions, and the workaround for that leaks straight into driver code.

found by James Forshaw, Google Project Zero

Exploiting a use-after-free race in the Linux kernel's vivid driver

There is a Linux driver whose entire job is to pretend. `vivid` emulates video4linux hardware (capture devices, output devices, radio receivers and transmitters, a software-defined radio). You can…

found by Alexander Popov, Positive Technologies

Late delimiters: NFKC normalization and host confusion in CPython's urlsplit

CPython's urlsplit found the host by scanning for delimiters, but IDNA normalizes the name afterwards with NFKC — and some characters only become delimiters once that happens. The first fix worked by…

found by Jonathan Birch (Microsoft) and Panayiotis Panayiotou

Zero-click block pool overflow in Marvell Avastar Wi-Fi firmware (CVE-2019-6496)

A Wi-Fi SoC is a whole second computer with its own RTOS and its own RAM, and the firmware Denis Selianin fuzzed would parse hostile beacon frames on a five-minute timer with nobody in the loop.

found by Denis Selianin, Embedi