Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

18 ℃

94%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 08:00:02

[USD] USD 77,353.59

[BRL] BRL 387,858.62 [USD] USD 77,353.59 [GBP] GBP 57,353.12 [EUR] EUR 66,440.39
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 08:27:18 up 248 days, 16:58, 3 users, load average: 0.00, 0.00, 0.00

[26/05/2026 07:49] Cláudio Castro é alvo de buscas pela PF em investigação contra aportes do Rioprevidência no Banco Master - O GLOBO

[25/05/2026 22:13] Deputado pede vista e votação da PEC 6x1 é adiada - CNN Brasil

[25/05/2026 20:25] Valdemar contradiz Flávio sobre visita a Vorcaro após 1ª prisão - Poder360

[25/05/2026 10:04] Caso Henry Borel: advogado de Jairinho infartou antes de júri - CNN Brasil

[25/05/2026 19:48] Lula autoriza envio de ajuda humanitária à Bolívia após onda de protestos - CNN Brasil

[25/05/2026 17:38] Causa da morte do fisiculturista Gabriel Ganley acomete 1 a cada 500 adultos - Notícias da TV

[25/05/2026 16:19] Quem votar em Flávio entregará a eleição para Lula, diz Zema - Poder360

[25/05/2026 22:17] Após terremoto no Chile de magnitude 6.9, tremor é sentido por moradores de São Paulo - Jovem Pan

[25/05/2026 21:08] Ciclone extratropical e frente fria se formam na costa do Sul do Brasil - Climatempo

[25/05/2026 09:47] Ex-presidente do BRB teria pressionado diretor a acelerar operações com o Master, diz PF - Correio Braziliense

[CVE-2026-1427] [Modified: 11-03-2026] [Analyzed] [V3.1 S8.8:HIGH] Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

[CVE-2026-1428] [Modified: 11-03-2026] [Analyzed] [V3.1 S8.8:HIGH] Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

[CVE-2026-1429] [Modified: 11-03-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

[CVE-2025-27821] [Modified: 27-01-2026] [Analyzed] [V3.1 S7.3:HIGH] Out-of-bounds Write vulnerability in Apache Hadoop HDFS native client. This issue affects Apache Hadoop: from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

[CVE-2025-59106] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.8:HIGH] The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.

[CVE-2026-24656] [Modified: 27-01-2026] [Analyzed] [V3.1 S3.7:LOW] Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

[CVE-2016-15057] [Modified: 27-01-2026] [Analyzed] [V3.1 S9.9:CRITICAL] ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

[CVE-2025-50537] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

[CVE-2025-67274] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints

[CVE-2025-70982] [Modified: 12-02-2026] [Analyzed] [V3.1 S9.9:CRITICAL] Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.

[CVE-2025-57783] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.

[CVE-2025-57784] [Modified: 18-02-2026] [Analyzed] [V3.1 S3.3:LOW] Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

[CVE-2025-57785] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

[CVE-2026-0925] [Modified: 09-03-2026] [Analyzed] [V3.1 S2.7:LOW] Tanium addressed an improper input validation vulnerability in Discover.

[CVE-2026-1224] [Modified: 09-03-2026] [Analyzed] [V3.1 S4.9:MEDIUM] Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

[CVE-2026-1446] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.0:MEDIUM] There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.

[CVE-2026-21509] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

[CVE-2026-24428] [Modified: 29-01-2026] [Analyzed] [V3.1 S8.8:HIGH] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.

[CVE-2026-24429] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated access to the management interface.

[CVE-2026-24430] [Modified: 28-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.