Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

25 ℃

66%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:30:01

[USD] USD 78,240.09

[BRL] BRL 397,500.36 [USD] USD 78,240.09 [GBP] GBP 58,701.35 [EUR] EUR 67,291.72
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:40:11 up 238 days, 23:11, 4 users, load average: 0.00, 0.00, 0.00

[16/05/2026 12:05] Datafolha 2º turno: Lula e Flávio têm 45% das intenções de voto - G1

[16/05/2026 06:39] Havengate: o fundo na mira da PF que conecta Vorcaro, Flávio e Eduardo Bolsonaro - BBC

[16/05/2026 10:13] Taiwan afirma que é uma nação “independente” após advertência de Trump - Correio do Povo

[16/05/2026 10:53] Tarcísio alega gripe e falta a evento com Flávio Bolsonaro em SP - Metrópoles

[16/05/2026 07:50] Análise: Como a Refit aliançou-se ao Centrão e ao bolsonarismo para lesar o erário - Valor Econômico

[16/05/2026 11:39] Joaquim Barbosa se filia ao DC e deve disputar a Presidência da República - G1

[16/05/2026 12:59] Ciro lança pré-candidatura, fala de 'lealdade', critica 'frouxos' e diz que vai resolver a segurança - Diário do Nordeste

[16/05/2026 10:22] Vídeo: chileno preso por racismo e homofobia imitou macaco em voo da Latam - CNN Brasil

[16/05/2026 12:42] Defesa Civil alerta: SP terá queda nas temperaturas e temporais até segunda-feira (18) - Olhar Digital

[16/05/2026 10:58] Três estados podem ter chuva acima de 100 mm antes da nova massa polar - MetSul Meteorologia

[CVE-2025-15104] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

[CVE-2025-68921] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.8:HIGH] SteelSeries Nahimic 3 1.10.7 allows Directory traversal.

[CVE-2026-21623] [Modified: 30-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.

[CVE-2026-21624] [Modified: 30-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.

[CVE-2026-21625] [Modified: 30-01-2026] [Analyzed] [V3.1 S8.8:HIGH] User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.

[CVE-2025-70746] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-71020] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2026-0949] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the Manage Charts menu.

[CVE-2026-22782] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.

[CVE-2026-23523] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.6:CRITICAL] Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’s machine. This vulnerability is fixed in 0.13.0.

[CVE-2026-23528] [Modified: 12-03-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashboard. It is possible for attackers to craft a phishing URL that assumes Jupyter Lab and Dask may be running on localhost and using default ports. If a user clicks on the malicious link it will open an error page in the Dask Dashboard via the Jupyter Lab proxy which will cause code to be executed by the default Jupyter Python kernel. This vulnerability is fixed in 2026.1.0.

[CVE-2024-44210] [Modified: 27-01-2026] [Analyzed] [V3.1 S3.3:LOW] This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data.

[CVE-2024-54556] [Modified: 27-01-2026] [Analyzed] [V3.1 S2.4:LOW] This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen.

[CVE-2025-24089] [Modified: 27-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.

[CVE-2025-24090] [Modified: 27-01-2026] [Analyzed] [V3.1 S3.3:LOW] A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.

[CVE-2025-31186] [Modified: 27-01-2026] [Analyzed] [V3.1 S3.3:LOW] A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.

[CVE-2025-43508] [Modified: 27-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.

[CVE-2025-48647] [Modified: 27-01-2026] [Analyzed] [V3.1 S7.8:HIGH] In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

[CVE-2025-68924] [Modified: 20-02-2026] [Analyzed] [V3.1 S7.5:HIGH] In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

[CVE-2026-23490] [Modified: 13-03-2026] [Analyzed] [V3.1 S7.5:HIGH] pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.