Common Weakness Enumeration

CWE-248

Allowed

Uncaught Exception

Abstraction: Base · Status: Draft

API response cwe.mitre.org

An exception is thrown from a function, but it is not caught.

610 vulnerabilities reference this CWE, most recent first.

GHSA-5WMX-573V-2QWQ

Vulnerability from github – Published: 2026-03-05 15:30 – Updated: 2026-06-06 00:53
VLAI
Summary
Python-Markdown has an Uncaught Exception
Details

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Markdown"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-69534"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T21:59:47Z",
    "nvd_published_at": "2026-03-05T15:16:11Z",
    "severity": "MODERATE"
  },
  "details": "Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.",
  "id": "GHSA-5wmx-573v-2qwq",
  "modified": "2026-06-06T00:53:00Z",
  "published": "2026-03-05T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69534"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Python-Markdown/markdown/issues/1534"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Python-Markdown/markdown/pull/1535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Python-Markdown/markdown"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Python-Markdown/markdown/actions/runs/15736122892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/06/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Python-Markdown has an Uncaught Exception"
}

GHSA-6287-HMPP-GMQM

Vulnerability from github – Published: 2024-03-27 18:32 – Updated: 2024-03-27 18:32
VLAI
Details

A vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly.

This vulnerability is due to improper handling of process-switched traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.

Severity
7.4 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-20276"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-27T17:15:51Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly.\n\n This vulnerability is due to improper handling of process-switched traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.",
  "id": "GHSA-6287-hmpp-gmqm",
  "modified": "2024-03-27T18:32:38Z",
  "published": "2024-03-27T18:32:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20276"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dos-Hq4d3tZG"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6429-3G3W-6MW5

Vulnerability from github – Published: 2022-05-07 00:00 – Updated: 2022-05-24 20:58
VLAI
Summary
Uncaught Exception in bignum
Details

All versions of the npm package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8. When verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "bignum"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.13.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-25324"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-24T20:58:02Z",
    "nvd_published_at": "2022-05-06T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "All versions of the npm package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8. When verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.",
  "id": "GHSA-6429-3g3w-6mw5",
  "modified": "2022-05-24T20:58:02Z",
  "published": "2022-05-07T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25324"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/justmoon/node-bignum"
    },
    {
      "type": "WEB",
      "url": "https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js#L111"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Uncaught Exception in bignum"
}

GHSA-64F4-QR63-VG45

Vulnerability from github – Published: 2023-07-06 15:30 – Updated: 2024-04-04 05:26
VLAI
Details

Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-1691"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-06T13:15:10Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.",
  "id": "GHSA-64f4-qr63-vg45",
  "modified": "2024-04-04T05:26:23Z",
  "published": "2023-07-06T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1691"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2023/7"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-654W-X4W9-5262

Vulnerability from github – Published: 2025-02-05 18:34 – Updated: 2025-02-05 18:34
VLAI
Details

A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.  This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-20171"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-05T17:15:23Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\n\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.\u0026nbsp;\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.",
  "id": "GHSA-654w-x4w9-5262",
  "modified": "2025-02-05T18:34:45Z",
  "published": "2025-02-05T18:34:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20171"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6753-GR46-6WPR

Vulnerability from github – Published: 2026-08-26 14:14 – Updated: 2026-08-26 14:14
VLAI
Summary
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Details

Summary

Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.

An authenticated user can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable. Additionally, supplying invalid field names or special Python attribute names can trigger unhandled exceptions that result in HTTP 500 responses.

Impact

An authenticated user with access to affected list endpoints may:

  • Bypass intended UI restrictions and perform sorting or filtering on fields that are not configured as searchable or sortable.
  • Cause affected API requests to fail with HTTP 500 responses by supplying invalid field names or special Python attribute names such as metadata or __class__.

This vulnerability may result in unauthorized use of query functionality and limited denial-of-service conditions affecting the targeted endpoint.

Affected Versions

All versions before 0.16.1.

Patched Versions

  • 0.16.1

Workarounds

There are no known workarounds. Users should upgrade to version 0.16.1 or later.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.16.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "starlette-admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54553"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-248",
      "CWE-602",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:14:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAffected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.\n\nAn authenticated user can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable. Additionally, supplying invalid field names or special Python attribute names can trigger unhandled exceptions that result in HTTP 500 responses.\n\n## Impact\n\nAn authenticated user with access to affected list endpoints may:\n\n* Bypass intended UI restrictions and perform sorting or filtering on fields that are not configured as searchable or sortable.\n* Cause affected API requests to fail with HTTP 500 responses by supplying invalid field names or special Python attribute names such as `metadata` or `__class__`.\n\nThis vulnerability may result in unauthorized use of query functionality and limited denial-of-service conditions affecting the targeted endpoint.\n\n## Affected Versions\n\nAll versions before 0.16.1.\n\n## Patched Versions\n\n* 0.16.1\n\n## Workarounds\n\nThere are no known workarounds. Users should upgrade to version 0.16.1 or later.",
  "id": "GHSA-6753-gr46-6wpr",
  "modified": "2026-08-26T14:14:37Z",
  "published": "2026-08-26T14:14:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/pull/776"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jowilf/starlette-admin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Starlette-Admin\u0027s unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS"
}

GHSA-6827-G8XF-36C7

Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32
VLAI
Details

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware checkBan is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:24Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.",
  "id": "GHSA-6827-g8xf-36c7",
  "modified": "2025-03-20T12:32:41Z",
  "published": "2025-03-20T12:32:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11172"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-68CJ-MVG9-RGM2

Vulnerability from github – Published: 2026-07-31 16:53 – Updated: 2026-07-31 16:53
VLAI
Summary
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
Details

Summary

CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers regexp.MustCompile() in pkg/api/forbidden_list.go:36, which panics and crashes the node admission webhook — causing a cluster-wide Denial of Service for all Node operations.

Root cause

internal/webhook/tenant/validation/ contains dedicated regex validators for every Tenant regex field (hostname, storageclass, ingressclass, containerregistry, etc.). internal/webhook/cfg/ contains no regex validator at all — only owners.go, serviceaccount.go, and warnings.go.

The downstream consumer internal/webhook/node/user_metadata.go calls:

// line 131
matched = forbiddenLabels.RegexMatch(label)
// line 150
matched = forbiddenAnnotations.RegexMatch(annotation)

Which routes to pkg/api/forbidden_list.go:36:

func (in ForbiddenListSpec) RegexMatch(value string) (ok bool) {
    if len(in.Regex) > 0 {
        ok = regexp.MustCompile(in.Regex).MatchString(value) // ← panics on invalid regex
    }
    return ok
}

Unlike regexp.Compile, regexp.MustCompile panics instead of returning an error. Since no webhook validates the CapsuleConfiguration regex fields before storage, a malformed value reaches MustCompile on every Node admission request.

Comparison with existing CVEs

GHSA-f94q-w3w8-cj67 and GHSA-gxjc-74v5-3vx3 affect individual Tenant fields — their validators existed but checked the wrong field. This issue is different: no validator exists at all for CapsuleConfiguration regex fields, and the blast radius is cluster-wide (all Nodes), not scoped to one tenant.

PoC

package main

import (
    "fmt"
    "regexp"
)

type ForbiddenListSpec struct{ Regex string }

// Exact copy of pkg/api/forbidden_list.go:34-38
func (in ForbiddenListSpec) RegexMatch(value string) bool {
    if len(in.Regex) > 0 {
        return regexp.MustCompile(in.Regex).MatchString(value)
    }
    return false
}

func main() {
    // 1. cfg webhook has no validator → invalid regex stored in etcd
    // (no webhook in internal/webhook/cfg/ checks regex fields)

    // 2. Stored malformed regex loaded from CapsuleConfiguration
    forbidden := ForbiddenListSpec{Regex: `[invalid-regex(`}

    // 3. node/user_metadata.go:131 called on every Node admission request
    defer func() {
        if r := recover(); r != nil {
            fmt.Printf("PANIC: %v\n", r)
            // Output: PANIC: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]
        }
    }()
    forbidden.RegexMatch("kubernetes.io/hostname")
}

Expected output:

PANIC: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]: `[invalid-regex(`

Fix

Add a node_metadata_regex.go handler to internal/webhook/cfg/ following the same pattern as forbidden_annotations_regex.go:

```go package cfg

import ( "context" "regexp"

  "sigs.k8s.io/controller-runtime/pkg/client"
  "sigs.k8s.io/controller-runtime/pkg/webhook/admission"

  capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
  ad "github.com/projectcapsule/capsule/pkg/runtime/admission"
  "github.com/projectcapsule/capsule/pkg/runtime/events"
  "github.com/projectcapsule/capsule/pkg/runtime/handlers"

)

type nodeMetadataRegexHandler struct{}

func NodeMetadataRegexHandler() handlers.TypedHandler[*capsulev1beta2.CapsuleConfiguration] { return &nodeMetadataRegexHandler{} }

func (h nodeMetadataRegexHandler) OnCreate( _ client.Client, _ client.Reader, cfg capsulev1beta2.CapsuleConfiguration, _ admission.Decoder, _ events.EventRecorder, ) handlers.Func { return func(_ context.Context, req admission.Request) *admission.Response { return h.validate(cfg, req) } }

func (h nodeMetadataRegexHandler) OnDelete( client.Client, client.Reader, capsulev1beta2.CapsuleConfiguration, admission.Decoder, events.EventRecorder, ) handlers.Func { return func(context.Context, admission.Request) *admission.Response { return nil } }

func (h nodeMetadataRegexHandler) OnUpdate( _ client.Client, _ client.Reader, cfg capsulev1beta2.CapsuleConfiguration, _ capsulev1beta2.CapsuleConfiguration, _ admission.Decoder, _ events.EventRecorder, ) handlers.Func { return func(_ context.Context, req admission.Request) admission.Response { return h.validate(cfg, req) } }

func (h nodeMetadataRegexHandler) validate(cfg capsulev1beta2.CapsuleConfiguration, req admission.Request) *admission.Response { if cfg.Spec.NodeMetadata == nil { return nil }

  expressions := map[string]string{
      "labels":      cfg.Spec.NodeMetadata.ForbiddenLabels.Regex,
      "annotations": cfg.Spec.NodeMetadata.ForbiddenAnnotations.Regex,
  }

  for scope, expression := range expressions {
      if expression == "" {
          continue
      }

      if _, err := regexp.Compile(expression); err != nil {
          return ad.Denyf(
              "unable to compile regex %q for forbidden %s: %v",
              expression,
              scope,
              err,
          )
      }
  }

  return nil

}

Step 2: Register the handler in cmd/controller/main.go:

route.ConfigValidation( cfgvalidation.Handler(cfg, cfgvalidation.WarningHandler(), cfgvalidation.ServiceAccountHandler(), cfgvalidation.OwnerHandler(), cfgvalidation.NodeMetadataRegexHandler(), // ← ADD THIS LINE ), ), ```

Impact

A Cluster Admin (or compromised admin account) can update CapsuleConfiguration with a malformed NodeMetadata regex (e.g., [invalid-regex(). The update is accepted without validation and persisted to etcd. Once stored, every subsequent Node admission request triggers regexp.MustCompile() with the invalid pattern, causing the Capsule node webhook to panic.

Affected operations (cluster-wide): - Node labeling, annotations, and taints (kubectl label/annotate/taint node) - Cluster autoscaler operations (cannot register or remove nodes) - Cloud provider node lifecycle management (metadata sync, status updates) - Node maintenance workflows (cordon, drain, uncordon)

Severity: This is a cluster-wide Denial of Service affecting all Node infrastructure operations. Unlike tenant-scoped CVEs (GHSA-f94q-w3w8-cj67, GHSA-gxjc-74v5-3vx3) that impact only Ingress or Namespace operations within a single tenant, this vulnerability blocks the entire cluster's ability to manage nodes.

The cluster cannot scale, perform maintenance, or process any node metadata changes until a Cluster Admin manually corrects the CapsuleConfiguration—requiring direct kubectl access with valid YAML.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.13.7"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/projectcapsule/capsule"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:53:25Z",
    "nvd_published_at": "2026-07-30T20:18:13Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node `CREATE`, `UPDATE`, or `PATCH` request triggers `regexp.MustCompile()` in `pkg/api/forbidden_list.go:36`, which **panics** and crashes the node admission webhook \u2014 causing a cluster-wide Denial of Service for all Node operations.\n\n### Root cause\n\n`internal/webhook/tenant/validation/` contains dedicated regex validators for every Tenant regex field (hostname, storageclass, ingressclass, containerregistry, etc.). `internal/webhook/cfg/` contains **no regex validator at all** \u2014 only `owners.go`, `serviceaccount.go`, and `warnings.go`.\n\nThe downstream consumer `internal/webhook/node/user_metadata.go` calls:\n```go\n// line 131\nmatched = forbiddenLabels.RegexMatch(label)\n// line 150\nmatched = forbiddenAnnotations.RegexMatch(annotation)\n```\n\nWhich routes to `pkg/api/forbidden_list.go:36`:\n```go\nfunc (in ForbiddenListSpec) RegexMatch(value string) (ok bool) {\n    if len(in.Regex) \u003e 0 {\n        ok = regexp.MustCompile(in.Regex).MatchString(value) // \u2190 panics on invalid regex\n    }\n    return ok\n}\n```\n\nUnlike `regexp.Compile`, `regexp.MustCompile` panics instead of returning an error. Since no webhook validates the `CapsuleConfiguration` regex fields before storage, a malformed value reaches `MustCompile` on every Node admission request.\n\n### Comparison with existing CVEs\n\n`GHSA-f94q-w3w8-cj67` and `GHSA-gxjc-74v5-3vx3` affect individual Tenant fields \u2014 their validators existed but checked the wrong field. This issue is different: **no validator exists at all** for `CapsuleConfiguration` regex fields, and the blast radius is cluster-wide (all Nodes), not scoped to one tenant.\n\n### PoC\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"regexp\"\n)\n\ntype ForbiddenListSpec struct{ Regex string }\n\n// Exact copy of pkg/api/forbidden_list.go:34-38\nfunc (in ForbiddenListSpec) RegexMatch(value string) bool {\n    if len(in.Regex) \u003e 0 {\n        return regexp.MustCompile(in.Regex).MatchString(value)\n    }\n    return false\n}\n\nfunc main() {\n    // 1. cfg webhook has no validator \u2192 invalid regex stored in etcd\n    // (no webhook in internal/webhook/cfg/ checks regex fields)\n\n    // 2. Stored malformed regex loaded from CapsuleConfiguration\n    forbidden := ForbiddenListSpec{Regex: `[invalid-regex(`}\n\n    // 3. node/user_metadata.go:131 called on every Node admission request\n    defer func() {\n        if r := recover(); r != nil {\n            fmt.Printf(\"PANIC: %v\\n\", r)\n            // Output: PANIC: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]\n        }\n    }()\n    forbidden.RegexMatch(\"kubernetes.io/hostname\")\n}\n```\n\nExpected output:\n```\nPANIC: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]: `[invalid-regex(`\n```\n\n### Fix\n Add a `node_metadata_regex.go` handler to `internal/webhook/cfg/` following the same pattern as `forbidden_annotations_regex.go`:\n\n  ```go\n  package cfg\n\n  import (\n      \"context\"\n      \"regexp\"\n\n      \"sigs.k8s.io/controller-runtime/pkg/client\"\n      \"sigs.k8s.io/controller-runtime/pkg/webhook/admission\"\n\n      capsulev1beta2 \"github.com/projectcapsule/capsule/api/v1beta2\"\n      ad \"github.com/projectcapsule/capsule/pkg/runtime/admission\"\n      \"github.com/projectcapsule/capsule/pkg/runtime/events\"\n      \"github.com/projectcapsule/capsule/pkg/runtime/handlers\"\n  )\n\n  type nodeMetadataRegexHandler struct{}\n\n  func NodeMetadataRegexHandler() handlers.TypedHandler[*capsulev1beta2.CapsuleConfiguration] {\n      return \u0026nodeMetadataRegexHandler{}\n  }\n\n  func (h *nodeMetadataRegexHandler) OnCreate(\n      _ client.Client,\n      _ client.Reader,\n      cfg *capsulev1beta2.CapsuleConfiguration,\n      _ admission.Decoder,\n      _ events.EventRecorder,\n  ) handlers.Func {\n      return func(_ context.Context, req admission.Request) *admission.Response {\n          return h.validate(cfg, req)\n      }\n  }\n\n  func (h *nodeMetadataRegexHandler) OnDelete(\n      client.Client,\n      client.Reader,\n      *capsulev1beta2.CapsuleConfiguration,\n      admission.Decoder,\n      events.EventRecorder,\n  ) handlers.Func {\n      return func(context.Context, admission.Request) *admission.Response {\n          return nil\n      }\n  }\n\n  func (h *nodeMetadataRegexHandler) OnUpdate(\n      _ client.Client,\n      _ client.Reader,\n      cfg *capsulev1beta2.CapsuleConfiguration,\n      _ *capsulev1beta2.CapsuleConfiguration,\n      _ admission.Decoder,\n      _ events.EventRecorder,\n  ) handlers.Func {\n      return func(_ context.Context, req admission.Request) *admission.Response {\n          return h.validate(cfg, req)\n      }\n  }\n\n  func (h *nodeMetadataRegexHandler) validate(cfg *capsulev1beta2.CapsuleConfiguration, req admission.Request) *admission.Response {\n      if cfg.Spec.NodeMetadata == nil {\n          return nil\n      }\n\n      expressions := map[string]string{\n          \"labels\":      cfg.Spec.NodeMetadata.ForbiddenLabels.Regex,\n          \"annotations\": cfg.Spec.NodeMetadata.ForbiddenAnnotations.Regex,\n      }\n\n      for scope, expression := range expressions {\n          if expression == \"\" {\n              continue\n          }\n\n          if _, err := regexp.Compile(expression); err != nil {\n              return ad.Denyf(\n                  \"unable to compile regex %q for forbidden %s: %v\",\n                  expression,\n                  scope,\n                  err,\n              )\n          }\n      }\n\n      return nil\n  }\n\n```\n```\n  Step 2: Register the handler in cmd/controller/main.go:\n\n  route.ConfigValidation(\n      cfgvalidation.Handler(cfg,\n          cfgvalidation.WarningHandler(),\n          cfgvalidation.ServiceAccountHandler(),\n          cfgvalidation.OwnerHandler(),\n          cfgvalidation.NodeMetadataRegexHandler(), // \u2190 ADD THIS LINE\n      ),\n  ),\n```\n\n\n### Impact\n\n A Cluster Admin (or compromised admin account) can update CapsuleConfiguration\n  with a malformed NodeMetadata regex (e.g., `[invalid-regex(`). The update is\n  accepted without validation and persisted to etcd. Once stored, every subsequent\n  Node admission request triggers `regexp.MustCompile()` with the invalid pattern,\n  causing the Capsule node webhook to panic.\n\n  **Affected operations (cluster-wide):**\n  - Node labeling, annotations, and taints (`kubectl label/annotate/taint node`)\n  - Cluster autoscaler operations (cannot register or remove nodes)\n  - Cloud provider node lifecycle management (metadata sync, status updates)\n  - Node maintenance workflows (cordon, drain, uncordon)\n\n  **Severity:**\n  This is a **cluster-wide Denial of Service** affecting all Node infrastructure\n  operations. Unlike tenant-scoped CVEs (GHSA-f94q-w3w8-cj67, GHSA-gxjc-74v5-3vx3)\n  that impact only Ingress or Namespace operations within a single tenant, this\n  vulnerability blocks the entire cluster\u0027s ability to manage nodes.\n\n  The cluster cannot scale, perform maintenance, or process any node metadata\n  changes until a Cluster Admin manually corrects the CapsuleConfiguration\u2014requiring\n  direct kubectl access with valid YAML.",
  "id": "GHSA-68cj-mvg9-rgm2",
  "modified": "2026-07-31T16:53:25Z",
  "published": "2026-07-31T16:53:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65834"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/projectcapsule/capsule"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests"
}

GHSA-6932-J9J3-FRP3

Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31
VLAI
Details

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-72644"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T20:17:16Z",
    "severity": "MODERATE"
  },
  "details": "Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.",
  "id": "GHSA-6932-j9j3-frp3",
  "modified": "2026-09-01T21:31:47Z",
  "published": "2026-09-01T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72644"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6M9Q-HWQP-8RV6

Vulnerability from github – Published: 2026-03-04 18:31 – Updated: 2026-03-04 18:31
VLAI
Details

Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.

This vulnerability is due to incomplete error checking when parsing remote procedure call (RPC) data. An attacker could exploit this vulnerability by sending crafted RPC packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-20068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-04T18:16:22Z",
    "severity": "MODERATE"
  },
  "details": "Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.\n\nThis vulnerability is due to incomplete error checking when parsing remote procedure call (RPC) data. An attacker could exploit this vulnerability by sending crafted RPC packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.",
  "id": "GHSA-6m9q-hwqp-8rv6",
  "modified": "2026-03-04T18:31:55Z",
  "published": "2026-03-04T18:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20068"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list