CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1961 vulnerabilities reference this CWE, most recent first.
GHSA-884H-9VV2-G8XV
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05In sspRequestCallback of BondStateMachine.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-183961896
{
"affected": [],
"aliases": [
"CVE-2021-0549"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-22T12:15:00Z",
"severity": "MODERATE"
},
"details": "In sspRequestCallback of BondStateMachine.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-183961896",
"id": "GHSA-884h-9vv2-g8xv",
"modified": "2022-05-24T19:05:53Z",
"published": "2022-05-24T19:05:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0549"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2021-06-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-889X-P867-8W2P
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.
{
"affected": [],
"aliases": [
"CVE-2021-3791"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-12T22:15:00Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.",
"id": "GHSA-889x-p867-8w2p",
"modified": "2022-05-24T19:20:28Z",
"published": "2022-05-24T19:20:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3791"
},
{
"type": "WEB",
"url": "https://binatoneglobal.com/security-advisory"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-88C9-3488-GX4H
Vulnerability from github – Published: 2023-10-25 21:30 – Updated: 2023-11-02 18:30A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
{
"affected": [],
"aliases": [
"CVE-2023-42857"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-25T19:15:10Z",
"severity": "LOW"
},
"details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.",
"id": "GHSA-88c9-3488-gx4h",
"modified": "2023-11-02T18:30:24Z",
"published": "2023-10-25T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42857"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213982"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213984"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213982"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213984"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Oct/19"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Oct/24"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-88PP-WQR9-8F77
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412.
{
"affected": [],
"aliases": [
"CVE-2021-3039"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-10T13:15:00Z",
"severity": "MODERATE"
},
"details": "An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412.",
"id": "GHSA-88pp-wqr9-8f77",
"modified": "2022-05-24T19:04:54Z",
"published": "2022-05-24T19:04:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3039"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2021-3039"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-89GH-3PGC-V5H2
Vulnerability from github – Published: 2026-07-22 22:54 – Updated: 2026-07-22 22:54Impact
Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemonade) are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workflow can read the header names and values, which typically contain API keys or other secrets.
Because execution data can be persisted to the database and exported, leaked values may remain accessible beyond the lifetime of a single execution.
This issue only affects instances where workflows use LLM sub-nodes with custom headers defined in their credentials.
Patches
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict access to execution data to fully trusted users only. - Avoid configuring custom headers in LLM node credentials; use alternative authentication mechanisms where possible. - Rotate any API keys or secrets that may have been stored as custom header values in affected credentials.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.64"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.30.0"
},
{
"fixed": "2.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.29.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65589"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:54:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\nCustom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemonade) are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workflow can read the header names and values, which typically contain API keys or other secrets.\n\nBecause execution data can be persisted to the database and exported, leaked values may remain accessible beyond the lifetime of a single execution.\n\nThis issue only affects instances where workflows use LLM sub-nodes with custom headers defined in their credentials.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict access to execution data to fully trusted users only.\n- Avoid configuring custom headers in LLM node credentials; use alternative authentication mechanisms where possible.\n- Rotate any API keys or secrets that may have been stored as custom header values in affected credentials.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-89gh-3pgc-v5h2",
"modified": "2026-07-22T22:54:01Z",
"published": "2026-07-22T22:54:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65589"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data"
}
GHSA-89PW-4635-WC84
Vulnerability from github – Published: 2022-05-14 01:57 – Updated: 2022-05-14 01:57Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password.
{
"affected": [],
"aliases": [
"CVE-2018-1198"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-17T16:29:00Z",
"severity": "HIGH"
},
"details": "Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password.",
"id": "GHSA-89pw-4635-wc84",
"modified": "2022-05-14T01:57:27Z",
"published": "2022-05-14T01:57:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1198"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2018-1198"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-89VG-R6G6-J7G4
Vulnerability from github – Published: 2022-05-13 00:01 – Updated: 2022-05-24 00:01In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
{
"affected": [],
"aliases": [
"CVE-2022-29928"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-12T09:15:00Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible",
"id": "GHSA-89vg-r6g6-j7g4",
"modified": "2022-05-24T00:01:45Z",
"published": "2022-05-13T00:01:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29928"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8CFG-VX93-JVXW
Vulnerability from github – Published: 2023-02-06 23:27 – Updated: 2024-05-20 19:48In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/client-go"
},
"ranges": [
{
"events": [
{
"introduced": "0.19.0"
},
{
"fixed": "0.19.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/client-go"
},
"ranges": [
{
"events": [
{
"introduced": "0.20.0-alpha.0"
},
{
"fixed": "0.20.0-alpha.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/client-go"
},
"ranges": [
{
"events": [
{
"introduced": "0.18.0"
},
{
"fixed": "0.18.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/client-go"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.0-alpha.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8565"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-06T23:27:56Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.5, \u003c= v1.18.13, \u003c= v1.17.15, \u003c v1.20.0-alpha2.",
"id": "GHSA-8cfg-vx93-jvxw",
"modified": "2024-05-20T19:48:09Z",
"published": "2023-02-06T23:27:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8565"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/95623"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/95316"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/client-go"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0064"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Kubernetes client-go vulnerable to Sensitive Information Leak via Log File"
}
GHSA-8CM5-JFJ2-26Q7
Vulnerability from github – Published: 2024-05-29 15:25 – Updated: 2024-05-31 20:44The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as @ and $, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.
This is caused by improper escaping of the SQLAlchemy password string, see here and here for more info.
Impact
Partial exposure of hosted database password in webserver logs
Patches
The vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds
There are no workarounds.
Proof of Concept
- Create a hosted PostgreSQL database for Fides with a password including
@or$e.g.p@ssword - Run Fides and observe failure, sample log attached
fides | 2024-02-28 14:27:52.609 | ERROR | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name "ssword@fides-db" to address: Name or service not known
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ethyca-fides"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.37.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34715"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-29T15:25:51Z",
"nvd_published_at": "2024-05-29T17:16:20Z",
"severity": "LOW"
},
"details": "The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.\n\nThis is caused by improper escaping of the SQLAlchemy password string, see [here](https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords) and [here](https://github.com/sqlalchemy/sqlalchemy/discussions/6615) for more info.\n\n### Impact\nPartial exposure of hosted database password in webserver logs\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of Concept\n1. Create a hosted PostgreSQL database for Fides with a password including `@` or `$` e.g. `p@ssword`\n2. Run Fides and observe failure, sample log attached\n\n```\nfides | 2024-02-28 14:27:52.609 | ERROR | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name \"ssword@fides-db\" to address: Name or service not known\n```",
"id": "GHSA-8cm5-jfj2-26q7",
"modified": "2024-05-31T20:44:41Z",
"published": "2024-05-29T15:25:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34715"
},
{
"type": "WEB",
"url": "https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c"
},
{
"type": "WEB",
"url": "https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords"
},
{
"type": "PACKAGE",
"url": "https://github.com/ethyca/fides"
},
{
"type": "WEB",
"url": "https://github.com/sqlalchemy/sqlalchemy/discussions/6615"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability"
}
GHSA-8CX5-6HGH-W2WV
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
{
"affected": [],
"aliases": [
"CVE-2020-2048"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-12T00:15:00Z",
"severity": "LOW"
},
"details": "An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.",
"id": "GHSA-8cx5-6hgh-w2wv",
"modified": "2022-05-24T17:33:53Z",
"published": "2022-05-24T17:33:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2048"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2020-2048"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.