Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

16 ℃

89%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 22:30:01

[USD] USD 62,390.31

[BRL] BRL 323,540.56 [USD] USD 62,390.31 [GBP] GBP 46,713.31 [EUR] EUR 54,529.82
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 22:44:37 up 287 days, 7:15, 6 users, load average: 0.01, 0.01, 0.00

[03/07/2026 20:14] Fifa mantém horários de México x Inglaterra e Brasil x Noruega, jogos deste domingo na Copa do Mundo - O GLOBO

[03/07/2026 19:00] Moraes lista arsenal de Bolsonaro e dá 48 horas para ex-presidente entregar armas; veja modelos - G1

[03/07/2026 14:10] "Vou para os EUA defender o PIX", diz Flávio Bolsonaro - CNN Brasil

[03/07/2026 08:03] PF prende alvo de sanção dos EUA em operação contra PCC - Poder360

[03/07/2026 17:53] Josmar Jozino: Rota já matou quatro suspeitos após tenente da tropa sofrer atentado em SP - UOL Notícias

[02/07/2026 17:25] Lista de políticos encontrada na cabeceira de Adilsinho vira peça-chave para PF - InfoMoney

[03/07/2026 14:26] Empresário do Crato vira réu por cárcere privado, stalking e violência doméstica contra advogada - O POVO

[03/07/2026 12:49] Diretora da Fiesp critica fim da 6 X 1 e reclama de salão fechado no sábado - Poder360

[03/07/2026 20:26] Michelle vira alvo de bolsonaristas após elogiar programa lançado por Lula - CNN Brasil

[03/07/2026 19:35] Ex-mulher de goleiro Bruno está desaparecida desde 5ª feira - Poder360

[CVE-2025-13476] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)

[CVE-2025-70229] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.

[CVE-2025-70230] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDDNS.

[CVE-2025-70231] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability.

[CVE-2025-70232] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.

[CVE-2025-70233] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetEnableWizard.

[CVE-2025-70616] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] A stack buffer overflow vulnerability exists in the Wincor Nixdorf wnBios64.sys kernel driver (version 1.2.0.0) in the IOCTL handler for code 0x80102058. The vulnerability is caused by missing bounds checking on the user-controlled Options parameter before copying data into a 40-byte stack buffer (Src[40]) using memmove. An attacker with local access can exploit this vulnerability by sending a crafted IOCTL request with Options > 40, causing a stack buffer overflow that may lead to kernel code execution, local privilege escalation, or denial of service (system crash). Additionally, the same IOCTL handler can leak kernel addresses and other sensitive stack data when reading beyond the buffer boundaries.

[CVE-2025-7375] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610 firmware versions prior to 1.6.0.

[CVE-2026-24457] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.1:CRITICAL] An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

[CVE-2026-25921] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.3:CRITICAL] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

[CVE-2026-26022] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.7:HIGH] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

[CVE-2026-26194] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

[CVE-2026-26195] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

[CVE-2026-26196] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.

[CVE-2026-26276] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.

[CVE-2026-26416] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests.

[CVE-2026-26417] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.

[CVE-2026-26418] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.

[CVE-2026-26998] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.4:MEDIUM] Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentication server is read entirely into memory without any size limit. There is no maxResponseBodySize configuration to restrict the amount of data read from the authentication server response. If the authentication server returns an unexpectedly large or unbounded response body, Traefik will allocate unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance. This issue has been patched in versions 2.11.38 and 3.6.9.

[CVE-2026-27023] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.0:MEDIUM] Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18.