Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

20 ℃

49%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 17:00:02

[USD] USD 80,801.96

[BRL] BRL 396,802.28 [USD] USD 80,801.96 [GBP] GBP 59,667.48 [EUR] EUR 68,811.68
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 17:02:48 up 235 days, 1:34, 3 users, load average: 0.02, 0.04, 0.01

[12/05/2026 12:46] Por que a UE vetou as exportações brasileiras de carne? Entenda - CNN Brasil

[12/05/2026 12:35] Lula destina R$ 330,6 mi para blindar 138 presídios do país - Poder360

[12/05/2026 11:27] Nunes Marques assume presidência do TSE com festa a R$ 800 o convite - Correio Braziliense

[12/05/2026 15:09] Cão Orelha não morreu por agressão de adolescentes, e MP pede arquivamento - UOL Notícias

[12/05/2026 05:55] Explosão atinge casas e deixa um morto em São Paulo - Revista Oeste

[12/05/2026 04:00] Além de triplex, Ciro Nogueira comprou R$ 7 milhões em imóveis em SP após se aliar ao Master - Metrópoles

[12/05/2026 15:27] Carreta desgovernada provoca acidente envolvendo 13 veículos no Anel Rodoviário de BH - O TEMPO

[12/05/2026 07:08] Chuvas: com volume superior a 40 mm, veja onde mais choveu em Pernambuco nesta terça (12) - Folha PE

[12/05/2026 11:51] ‘Pai de pet’, deputado Marcelo Queiroz é investigado por desvio milionário em castração - Jovem Pan

[12/05/2026 08:01] Irã dá ultimato aos Estados Unidos para que aceitem o plano de paz - CartaCapital

[CVE-2025-46066] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.9:CRITICAL] An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges

[CVE-2025-46067] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.2:HIGH] An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file

[CVE-2025-46068] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.8:HIGH] An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism

[CVE-2025-46070] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component

[CVE-2025-63314] [Modified: 22-01-2026] [Analyzed] [V3.1 S10.0:CRITICAL] A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

[CVE-2025-66689] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the is_dangerous_path() validation function that uses exact string matching against a blacklist of system directories. Attackers can bypass these restrictions by accessing subdirectories of blacklisted paths.

[CVE-2025-68622] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.

[CVE-2025-68276] [Modified: 16-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

[CVE-2025-68468] [Modified: 16-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.

[CVE-2025-68471] [Modified: 16-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

[CVE-2025-68656] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate use-after-free when processing attacker-controlled Report Descriptor lengths. This vulnerability is fixed in 1.1.0.

[CVE-2025-68657] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.

[CVE-2026-22033] [Modified: 27-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.

[CVE-2026-22050] [Modified: 22-01-2026] [Analyzed] [V3.1 S4.3:MEDIUM] ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.

[CVE-2026-22250] [Modified: 27-01-2026] [Analyzed] [V3.1 S2.5:LOW] wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

[CVE-2026-22251] [Modified: 27-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

[CVE-2026-22200] [Modified: 27-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.

[CVE-2026-22252] [Modified: 15-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

[CVE-2026-22771] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.

[CVE-2026-22776] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.5:HIGH] cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.