Skip to content

Commit 7ec44d8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-26pg-g54q-jv62 GHSA-59jh-85v4-gxrf GHSA-5pmq-jgg5-3j6q GHSA-8r42-22r7-vfg2 GHSA-j9xr-5c85-xjhm GHSA-p6wp-hhx9-7jj5 GHSA-w54f-pw7x-c532
1 parent 90151be commit 7ec44d8

File tree

7 files changed

+280
-0
lines changed

7 files changed

+280
-0
lines changed

‎advisories/unreviewed/2026/04/GHSA-26pg-g54q-jv62/GHSA-26pg-g54q-jv62.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-26pg-g54q-jv62",
4+
"modified": "2026-04-12T21:30:19Z",
5+
"published": "2026-04-12T21:30:19Z",
6+
"aliases": [
7+
"CVE-2026-40394"
8+
],
9+
"details": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40394"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.varnish-software.com/security/VEV00002"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-670"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-12T20:16:17Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-59jh-85v4-gxrf/GHSA-59jh-85v4-gxrf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-59jh-85v4-gxrf",
4+
"modified": "2026-04-12T21:30:19Z",
5+
"published": "2026-04-12T21:30:19Z",
6+
"aliases": [
7+
"CVE-2026-40395"
8+
],
9+
"details": "Varnish Enterprise before 6.0.16r12 allows a \"workspace overflow\" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40395"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.varnish-software.com/security/VEV00003"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-12T20:16:18Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-5pmq-jgg5-3j6q/GHSA-5pmq-jgg5-3j6q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5pmq-jgg5-3j6q",
4+
"modified": "2026-04-12T21:30:19Z",
5+
"published": "2026-04-12T21:30:19Z",
6+
"aliases": [
7+
"CVE-2026-40396"
8+
],
9+
"details": "Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40396"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/varnish/varnish/issues/15"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-670"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-12T20:16:19Z"
39+
}
40+
}

‎advisories/unreviewed/2026/04/GHSA-8r42-22r7-vfg2/GHSA-8r42-22r7-vfg2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8r42-22r7-vfg2",
4+
"modified": "2026-04-12T21:30:19Z",
5+
"published": "2026-04-12T21:30:19Z",
6+
"aliases": [
7+
"CVE-2026-6129"
8+
],
9+
"details": "A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6129"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zhayujie/chatgpt-on-wechat/issues/2741"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/zhayujie/chatgpt-on-wechat/issues/2741#issue-4191903266"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/submit/795272"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/vuln/356992"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/vuln/356992/cti"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-287"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-04-12T20:16:19Z"
55+
}
56+
}

‎advisories/unreviewed/2026/04/GHSA-j9xr-5c85-xjhm/GHSA-j9xr-5c85-xjhm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j9xr-5c85-xjhm",
4+
"modified": "2026-04-12T21:30:18Z",
5+
"published": "2026-04-12T21:30:18Z",
6+
"aliases": [
7+
"CVE-2026-40385"
8+
],
9+
"details": "In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40385"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-190"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-12T19:16:20Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-p6wp-hhx9-7jj5/GHSA-p6wp-hhx9-7jj5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p6wp-hhx9-7jj5",
4+
"modified": "2026-04-12T21:30:18Z",
5+
"published": "2026-04-12T21:30:18Z",
6+
"aliases": [
7+
"CVE-2026-40386"
8+
],
9+
"details": "In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40386"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-191"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-04-12T19:16:20Z"
35+
}
36+
}

‎advisories/unreviewed/2026/04/GHSA-w54f-pw7x-c532/GHSA-w54f-pw7x-c532.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w54f-pw7x-c532",
4+
"modified": "2026-04-12T21:30:19Z",
5+
"published": "2026-04-12T21:30:18Z",
6+
"aliases": [
7+
"CVE-2026-40393"
8+
],
9+
"details": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40393"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39866"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://lists.freedesktop.org/archives/mesa-dev/2026-February/226597.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-787"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-04-12T19:16:20Z"
39+
}
40+
}

0 commit comments

Comments
 (0)