CVE-2022-44638

pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write

In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Pixman and 1 more

Products

Debian Linux Fedora Pixman and 2 more

CVE-2022-40284

NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Advanced Virtualization and 6 more

CVE-2025-22869

Potential denial of service in golang.org/x/crypto

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Redhat

Products

Ssh Acm Advanced Cluster Security and 14 more

CVE-2025-22868

Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Redhat

Products

Jws Acm Advanced Cluster Security and 16 more

CVE-2023-5176

Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 6 more

CVE-2021-44790

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

CVSS 3.1 · 9.8 Critical EPSS 96.8% KEV · Not listed

Vendors

Apache Apple Debian and 5 more

Products

Http Server Mac Os X Macos and 17 more

CVE-2023-27522

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Apache Debian Redhat and 1 more

Products

Http Server Debian Linux Enterprise Linux and 3 more

CVE-2022-45060

varnish: Request Forgery Vulnerability

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 2 more

Products

Debian Linux Fedora Enterprise Linux and 8 more

CVE-2024-21892

nodejs: code injection and privilege escalation through Linux capabilities

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Nodejs Redhat

Products

Linux Kernel Node.js Enterprise Linux and 1 more

CVE-2022-35256

nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Debian Llhttp Nodejs and 2 more

Products

Debian Linux Llhttp Node.js and 4 more

CVE-2022-32213

nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

CVSS 3.1 · 6.5 Medium EPSS 44.8% KEV · Not listed

Vendors

Debian Fedoraproject Llhttp and 4 more

Products

Debian Linux Fedora Llhttp and 6 more

CVE-2022-32212

nodejs: DNS rebinding in --inspect via invalid IP addresses

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

CVSS 3.1 · 8.1 High EPSS 6.4% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 2 more

Products

Debian Linux Fedora Node.js and 4 more

CVE-2022-32214

nodejs: HTTP request smuggling due to improper delimiting of header fields

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

CVSS 3.1 · 6.5 Medium EPSS 81.8% KEV · Not listed

Vendors

Debian Llhttp Nodejs and 2 more

Products

Debian Linux Llhttp Node.js and 4 more

CVE-2022-32215

nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

CVSS 3.1 · 6.5 Medium EPSS 70.2% KEV · Not listed

Vendors

Debian Fedoraproject Llhttp and 4 more

Products

Debian Linux Fedora Llhttp and 6 more

CVE-2022-21824

nodejs: Prototype pollution via console.table properties

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

CVSS 3.1 · 8.2 High EPSS 21.5% KEV · Not listed

Vendors

Debian Netapp Nodejs and 2 more

Products

Debian Linux Oncommand Insight Oncommand Workflow Automation and 13 more

CVE-2021-44532

nodejs: Certificate Verification Bypass via String Injection

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

CVSS 3.1 · 5.3 Medium EPSS 10.4% KEV · Not listed

Vendors

Debian Nodejs Oracle and 1 more

Products

Debian Linux Node.js Graalvm and 11 more

CVE-2021-44531

nodejs: Improper handling of URI Subject Alternative Names

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

CVSS 3.1 · 7.4 High EPSS 8.4% KEV · Not listed

Vendors

Nodejs Oracle Redhat

Products

Node.js Graalvm Mysql Cluster and 10 more

CVE-2021-22960

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Debian Llhttp Oracle and 1 more

Products

Debian Linux Llhttp Graalvm and 4 more

CVE-2021-22959

llhttp: HTTP Request Smuggling due to spaces in headers

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Debian Llhttp Oracle and 1 more

Products

Debian Linux Llhttp Graalvm and 4 more

CVE-2021-22939

nodejs: Incomplete validation of tls rejectUnauthorized parameter

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS 3.1 · 5.3 Medium EPSS 14.7% KEV · Not listed

Vendors

Debian Netapp Nodejs and 3 more

Products

Debian Linux Nextgen Api Node.js and 8 more