Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

17 ℃

90%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 18:00:02

[USD] USD 76,973.15

[BRL] BRL 389,468.73 [USD] USD 76,973.15 [GBP] GBP 57,449.29 [EUR] EUR 66,325.45
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 18:15:16 up 242 days, 2:46, 3 users, load average: 0.00, 0.00, 0.00

[19/05/2026 12:55] Vorcaro bancou mais de 90% do orçamento de filme sobre Jair Bolsonaro, diz dona da produtora - G1

[19/05/2026 13:37] Lula tem 48,9% contra 41,8% de Flávio no 2º turno, diz AtlasIntel - Poder360

[19/05/2026 10:40] PF apura conduta de perito que teria vazado contrato da esposa de Moraes - Correio Braziliense

[19/05/2026 16:08] Desembargador que estava desaparecido há um mês é encontrado morto no Rio - CNN Brasil

[19/05/2026 08:29] Jovem filha de diplomatas é atropelada e morta em Ipanema horas após desembarcar no Rio - Estadão

[19/05/2026 13:35] 'Fim da escala 6x1 não vai quebrar empresas', diz CEO do ramo cafeeiro - UOL Economia

[19/05/2026 08:05] Porta de avião abre no ar? Entenda caso em voo da Latam - CNN Brasil

[19/05/2026 06:45] Vorcaro é transferido para cela comum na PF após entregar proposta de delação - ND Mais

[19/05/2026 16:58] Presidente do PT descarta candidatura de Pacheco ao governo de Minas e diz que partido busca alternativa para eleição estadual - O Globo

[19/05/2026 13:10] Precatórios do Fundef: Elmano autoriza pagamento da 5ª parcela a professores do Ceará - O POVO

[CVE-2025-52659] [Modified: 25-04-2026] [Analyzed] [V3.1 S2.8:LOW] HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.

[CVE-2025-52660] [Modified: 25-04-2026] [Analyzed] [V3.1 S2.7:LOW] HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

[CVE-2025-52661] [Modified: 25-04-2026] [Analyzed] [V3.1 S2.4:LOW] HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.

[CVE-2025-55249] [Modified: 25-04-2026] [Analyzed] [V3.1 S3.5:LOW] HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.

[CVE-2025-55251] [Modified: 25-04-2026] [Analyzed] [V3.1 S3.1:LOW] HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

[CVE-2026-23533] [Modified: 28-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

[CVE-2026-23534] [Modified: 28-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

[CVE-2026-23625] [Modified: 02-02-2026] [Analyzed] [V3.1 S8.7:HIGH] OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work packages from a different project (e.g., a subproject), the helper link_to_work_package prepends package.project.to_s to the link and returns the entire string with .html_safe. Because project names are user-controlled and no escaping happens before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. The underlying issue is mitigated in versions 16.6.5 and 17.0.0 by setting a `X-Content-Type-Options: nosniff` header, which was in place until a refactoring move to Rails standard content-security policy, which did not properly apply this header in the new configuration since OpenProject 16.3.0. Those who cannot upgrade their installations should ensure that they add a X-Content-Type-Options: nosniff header in their proxying web application server.

[CVE-2026-23646] [Modified: 02-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.

[CVE-2026-23721] [Modified: 02-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available.

[CVE-2026-23732] [Modified: 28-01-2026] [Analyzed] [V3.1 S7.5:HIGH] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.

[CVE-2026-23833] [Modified: 04-03-2026] [Analyzed] [V3.1 S7.5:HIGH] ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices.

[CVE-2026-23836] [Modified: 18-02-2026] [Analyzed] [V3.1 S9.9:CRITICAL] HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.

[CVE-2026-23883] [Modified: 28-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

[CVE-2026-23884] [Modified: 28-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

[CVE-2025-55250] [Modified: 25-04-2026] [Analyzed] [V3.1 S1.8:LOW] HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.

[CVE-2025-55252] [Modified: 25-04-2026] [Analyzed] [V3.1 S3.1:LOW] HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access

[CVE-2025-69198] [Modified: 02-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system. Version 1.12.0 fixes the issue.

[CVE-2026-23839] [Modified: 03-02-2026] [Analyzed] [V3.1 S9.3:CRITICAL] Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.

[CVE-2026-23840] [Modified: 03-02-2026] [Analyzed] [V3.1 S9.3:CRITICAL] Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryDeleted=`. Version 0.70.0 fixes the issue.