Skip to content

Commit b07a832

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-38h3-2333-qx47 GHSA-8wmw-prw8-2ggm GHSA-xw5c-jc7x-gf75
1 parent d855392 commit b07a832

File tree

3 files changed

+145
-15
lines changed

3 files changed

+145
-15
lines changed

‎advisories/github-reviewed/2026/04/GHSA-38h3-2333-qx47/GHSA-38h3-2333-qx47.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38h3-2333-qx47",
4+
"modified": "2026-04-18T01:05:12Z",
5+
"published": "2026-04-18T01:05:12Z",
6+
"aliases": [
7+
"CVE-2026-41078"
8+
],
9+
"summary": "OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path",
10+
"details": "### Summary\n\n> [!IMPORTANT] \n> There is no plan to fix this issue as `OpenTelemetry.Exporter.Jaeger` was deprecated in 2023. It is for informational purposes only.\n\n`OpenTelemetry.Exporter.Jaeger` may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service.\n\n### Details\n\nThe Jaeger exporter conversion path can append tag/event data into pooled list structures. In affected versions, pooled allocation sizing may be influenced by large observed payloads and reused globally across later allocations, resulting in persistent oversized rentals and elevated memory pressure. In environments where telemetry attributes/events can be influenced by untrusted input and limits are increased from defaults, this may lead to process instability or denial of service.\n\n### Impact\n\nAvailability impact only. Confidentiality and integrity impacts are not expected.\n\n### Workarounds / Mitigations\n\n* Prefer maintained exporters (for example OpenTelemetry Protocol format (OTLP)) instead of the Jaeger exporter.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "OpenTelemetry.Exporter.Jaeger"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.6.0-rc.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/open-telemetry/opentelemetry-dotnet"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-400",
51+
"CWE-770"
52+
],
53+
"severity": "MODERATE",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-04-18T01:05:12Z",
56+
"nvd_published_at": null
57+
}
58+
}

advisories/unreviewed/2026/04/GHSA-8wmw-prw8-2ggm/GHSA-8wmw-prw8-2ggm.json renamed to advisories/github-reviewed/2026/04/GHSA-8wmw-prw8-2ggm/GHSA-8wmw-prw8-2ggm.json

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,47 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8wmw-prw8-2ggm",
4-
"modified": "2026-04-17T15:31:18Z",
4+
"modified": "2026-04-18T01:03:36Z",
55
"published": "2026-04-17T15:31:18Z",
66
"aliases": [
77
"CVE-2026-31317"
88
],
9-
"details": "Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file",
10-
"severity": [],
11-
"affected": [],
9+
"summary": "Craftql vulnerable to Server-Side Request Forgery",
10+
"details": "Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Listeners/GetAssetsFieldSchema.php file.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "markhuot/craftql"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.3.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31317"
1642
},
1743
{
18-
"type": "WEB",
44+
"type": "PACKAGE",
1945
"url": "https://github.com/markhuot/craftql"
2046
},
2147
{
@@ -28,10 +54,12 @@
2854
}
2955
],
3056
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
33-
"github_reviewed": false,
34-
"github_reviewed_at": null,
57+
"cwe_ids": [
58+
"CWE-918"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-18T01:03:36Z",
3563
"nvd_published_at": "2026-04-17T14:16:33Z"
3664
}
3765
}

advisories/unreviewed/2026/04/GHSA-xw5c-jc7x-gf75/GHSA-xw5c-jc7x-gf75.json renamed to advisories/github-reviewed/2026/04/GHSA-xw5c-jc7x-gf75/GHSA-xw5c-jc7x-gf75.json

Lines changed: 50 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,59 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xw5c-jc7x-gf75",
4-
"modified": "2026-04-17T15:31:18Z",
4+
"modified": "2026-04-18T01:04:38Z",
55
"published": "2026-04-17T15:31:18Z",
66
"aliases": [
77
"CVE-2026-40458"
88
],
9-
"details": "PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.\n\nThis issue was fixed in PAC4J versions 5.7.10 and 6.4.1",
9+
"summary": "PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability",
10+
"details": "PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.\n\nThis issue was fixed in PAC4J versions 5.7.10 and 6.4.1.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.pac4j:pac4j-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.7.10"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.pac4j:pac4j-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "6.0.0-RC1"
48+
},
49+
{
50+
"fixed": "6.4.1"
51+
}
52+
]
53+
}
54+
]
1455
}
1556
],
16-
"affected": [],
1757
"references": [
1858
{
1959
"type": "ADVISORY",
@@ -23,6 +63,10 @@
2363
"type": "WEB",
2464
"url": "https://cert.pl/en/posts/2026/04/CVE-2026-40458"
2565
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/pac4j/pac4j"
69+
},
2670
{
2771
"type": "WEB",
2872
"url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html"
@@ -33,8 +77,8 @@
3377
"CWE-352"
3478
],
3579
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-04-18T01:04:38Z",
3882
"nvd_published_at": "2026-04-17T14:16:33Z"
3983
}
4084
}

0 commit comments

Comments
 (0)