Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

16 ℃

70%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 20:00:02

[USD] USD 63,410.72

[BRL] BRL 330,021.07 [USD] USD 63,410.72 [GBP] GBP 47,535.53 [EUR] EUR 54,981.28
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 20:11:38 up 262 days, 4:42, 5 users, load average: 0.00, 0.00, 0.00

[08/06/2026 15:54] A resposta do AtlasIntel após Kassio derrubar pesquisa que mostra Flávio Bolsonaro em queda - CartaCapital

[08/06/2026 18:12] Eleições no Peru: De onde vêm as cédulas que ainda precisam ser contadas? - CNN Brasil

[08/06/2026 14:16] Como Trump tenta influenciar eleições em outros países — e por que seu apoio nem sempre tem o resultado esperado - BBC

[08/06/2026 14:14] PM do RJ é presa por furto de fone de ouvido no Aeroporto de BH - G1

[08/06/2026 14:25] Apple anuncia iOS 27 com novo Liquid Glass: confira as melhorias - TecMundo

[08/06/2026 04:52] Israel ataca alvos no Irã e desafia pedido de Trump por trégua - Poder360

[08/06/2026 12:05] Governo prepara linha de crédito para motociclistas de aplicativos - Agência Brasil

[08/06/2026 15:08] MPF aciona Justiça para que Hospital Albert Einstein cumpra lei de cotas na residência - UOL Notícias

[08/06/2026 10:24] Flávio Bolsonaro sobre veto à carne: ‘Problema do Lula que vou resolver’ - Estado de Minas

[08/06/2026 13:20] Alckmin anuncia R$ 35 bilhões em crédito para tratores e caminhões - Brasil 247

[CVE-2026-2179] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-2180] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.

[CVE-2026-2181] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

[CVE-2026-2182] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

[CVE-2026-2183] [Modified: 24-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an unknown part of the file /restructured/csv.php. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The code repository of the project has not been active for many years.

[CVE-2026-2184] [Modified: 24-02-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.

[CVE-2026-2185] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda RX3 16.03.13.11. This issue affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. This manipulation of the argument devName/mac causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

[CVE-2026-2186] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda RX3 16.03.13.11. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument list leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

[CVE-2026-2187] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was found in Tenda RX3 16.03.13.11. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

[CVE-2026-2188] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-2189] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manipulation of the argument ay leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

[CVE-2026-2190] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

[CVE-2026-2191] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A weakness has been identified in Tenda AC9 15.03.06.42_multi. Affected is the function formGetDdosDefenceList. This manipulation of the argument security.ddos.map causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

[CVE-2026-2192] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A security vulnerability has been detected in Tenda AC9 15.03.06.42_multi. Affected by this vulnerability is the function formGetRebootTimer. Such manipulation of the argument sys.schedulereboot.start_time/sys.schedulereboot.end_time leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-2193] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argument usb_username results in command injection. Remote exploitation of the attack is possible.

[CVE-2026-2194] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.

[CVE-2026-2195] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessments/pretest/questions-view.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

[CVE-2026-2196] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments/pretest/exam-update.php. The manipulation of the argument test_id results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

[CVE-2026-2197] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/pretest/exam-delete.php. This manipulation of the argument test_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-2198] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/assessments/pretest/loaddata.php. Such manipulation of the argument difficulty_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.