generated 2026-10-20 05:02 UTC
Containers, published 2026-10-20
Flagged for matching Docker.
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
In practice: exploitable over the network, requires no privileges, needs no user interaction.
References:
Containers, Web / App Stack, published 2026-10-20
Flagged for matching Docker, MySQL.
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
In practice: exploitable over the network, requires no privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-19
Flagged for matching PHP.
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
In practice: exploitable over the network, requires no privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-20
Flagged for matching MySQL.
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
In practice: exploitable over the network, requires low privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-20
Flagged for matching Apache HTTP Server.
Summary
Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstreamrequestfilter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.
Impact
Specifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's net/http/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.
Note that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.
Mitigation:
Upgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::httpupstreamrequest_policy (HttpUpstreamRequestPolicy). Fix commits: https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded , https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee
Do not use HttpUpstreamRequestPolicy::preserve() if the origin relies on headers added by Pingora; it restores the old passthrough behavior.
If you cannot upgrade: in upstreamrequestfilter, remove the Connection header and every header it nominates before adding trusted headers.
In practice: exploitable over the network, requires no privileges, needs no user interaction.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.
A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allowdupkeys, dupkeysas_arrayref or relaxed is set.
A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag.
With allowtags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against maxdepth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decode_hv.
With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.
From 4.41, under dupkeysasarrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.
Untrusted JSON decoded with relaxed and dupkeysasarrayref can crash the process or dereference an address chosen by a JSON number.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv.
With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.
Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.
With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSONTYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.
Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decode_hv.
With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.
Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse.
The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.
A peer streaming data to an incrparse consumer can exhaust process memory regardless of maxsize.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv.
With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.
This corrupts stack or heap memory and can crash the process.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.
A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.
allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.
A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.
encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.
Repeatedly encoding data that contains such values grows process memory without bound.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.
With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.
A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
References:
Control Panels, published 2026-10-19
Flagged for matching cPanel.
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.
At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.
A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
References:
Web / App Stack, published 2026-10-19
Flagged for matching Apache HTTP Server.
Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's
SME Server version 11.0rc1-215, allowing an attacker with high privileges
to inject reserved Apache configuration directives, corrupting
httpd.conf and preventing Apache from starting after a server reboot,
resulting in a denial-of-service (DoS) condition affecting the web
server and its hosted virtual hosts.
References: