Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

14 ℃

90%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 09:00:02

[USD] USD 62,604.26

[BRL] BRL 324,599.93 [USD] USD 62,604.26 [GBP] GBP 46,752.73 [EUR] EUR 54,740.72
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 09:09:05 up 288 days, 17:40, 6 users, load average: 0.00, 0.00, 0.00

[05/07/2026 00:01] Datafolha: Tarcísio lidera em SP com 46%, e Haddad tem 30% - 05/07/2026 - Política - Folha de S.Paulo

[04/07/2026 18:13] Flávio Bolsonaro embarca para os EUA para audiência sobre novo tarifaço - CNN Brasil

[04/07/2026 10:37] Funeral de Ali Khamenei: Milhares comparecem à cerimônia em Teerã - G1

[04/07/2026 17:14] Pivô da briga entre Flávio e Michelle, vereadora do Ceará diz que não vai alimentar conflitos e reforça apoio a senador - O GLOBO

[04/07/2026 06:04] Entenda como foi o processo de independência dos EUA - Poder360

[04/07/2026 16:06] Técnico da Noruega faz comparação exótica entre Vini Jr e Haaland antes de Brasil x Noruega na Copa do Mundo - ESPN Brasil

[04/07/2026 16:59] Moraes manda apreender 11 armas de Bolsonaro; leia a lista - Poder360

[04/07/2026 03:55] PF vê prejuízo após ação dos EUA em investigação sobre o PCC - Correio Braziliense

[04/07/2026 07:30] Até -5°C e alerta de geada: massa de ar polar faz temperaturas despencarem neste sábado (4) - ND Mais

[04/07/2026 07:16] Suspeito de atirar em tenente da Rota em SP pode estar em fuga com a família - Rádio Itatiaia

[CVE-2026-2219] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

[CVE-2026-3661] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

[CVE-2026-3662] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation of the argument Pr_mode leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

[CVE-2026-29067] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.

[CVE-2026-29184] [Modified: 17-06-2026] [Analyzed] [V3.1 S2.0:LOW] Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.

[CVE-2026-29185] [Modified: 17-06-2026] [Analyzed] [V3.1 S2.7:LOW] Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.

[CVE-2026-29191] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.3:CRITICAL] ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.

[CVE-2026-29192] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.7:HIGH] ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.

[CVE-2026-29193] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton. This issue has been patched in version 4.12.1.

[CVE-2026-3663] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_document.cpp of the component XLSX File Parser. Performing a manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been made public and could be used. The patch is named 147. It is recommended to apply a patch to fix this issue.

[CVE-2026-3664] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 147. Applying a patch is advised to resolve this issue.

[CVE-2026-29076] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.9:MEDIUM] cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

[CVE-2026-29190] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.1:MEDIUM] Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a malicious backup file is provided to Karapace, an attacker may exploit insufficient path validation to perform arbitrary file read on the system where Karapace is running. The issue affects deployments that use the backup/restore functionality and process backups from untrusted sources. The impact depends on the file system permissions of the Karapace process. This issue has been patched in version 6.0.0.

[CVE-2026-29194] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.1:HIGH] Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is authorized to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations. This issue has been patched in version 1.5.0.

[CVE-2026-29771] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Netmaker makes networks with WireGuard. Prior to version 1.2.0, the /api/server/shutdown endpoint allows termination of the Netmaker server process via syscall.SIGINT. This allows any user to repeatedly shut down the server, causing cyclic denial of service with approximately 3-second restart intervals. This issue has been patched in version 1.2.0.

[CVE-2026-29778] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The current protection relies on a single-pass string replacement of "../", which can be bypassed using crafted recursive traversal sequences. This issue has been patched in version 0.5.0b3.dev97.

[CVE-2026-29779] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This issue has been patched via commit 377a596.

[CVE-2026-29780] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursively_extract_attachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted from parsed emails are directly used to construct output file paths without any sanitization, allowing an attacker-controlled filename to escape the target directory. This issue has been patched in version 2.0.1.

[CVE-2026-29781] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Sliver is a command and control framework that uses a custom Wireguard netstack. In versions from 1.7.3 and prior, a vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. By extracting valid implant credentials and omitting nested fields in a signed message, an authenticated actor can trigger an unhandled runtime panic. Because the mTLS, WireGuard, and DNS transport layers lack the panic recovery middleware present in the HTTP transport, this results in a global process termination. While requiring post-authentication access (a captured implant), this flaw effectively acts as an infrastructure "kill-switch," instantly severing all active sessions across the entire fleet and requiring a manual server restart to restore operations. At time of publication, there are no publicly available patches.

[CVE-2026-29784] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.