https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:33:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329661 EUVD-2026-329661 https://cve.radiocsirt.org/vuln/euvd-2026-329661 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55517 <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.</p> <p>Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55517 https://cve.radiocsirt.org/vuln/ghsa-x2qc-cmh9-f4hf <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>A Deno program that opens a client `WebSocket` connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that aborted the entire Deno process.</p> <p>## Details</p> <p>When establishing a client WebSocket connection, Deno read the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers from the server&#39;s `101 Switching Protocols` response and converted them to strings without handling the failure case. `HeaderValue::to_str()` returns an error for any value containing bytes outside the visible-ASCII range, so a header carrying such bytes triggered an unrecoverable error during conversion.</p> <p>Because the client initiates the outbound connection, the handshake response is fully controlled by the server. A server that returns bytes such as `0xFF 0xFE` in either header could therefore crash any client that connected to it.</p> <p>This is purely an availability issue. There is no information disclosure and no memory-safety impact; the only effect is termination of the current process.</p> <p>## Impact</p> <p>Remote denial of service. Any Deno application that establishes WebSocket connections to untrusted or potentially-compromised endpoints could be terminated by the remote peer. Exploitation requires the victim applicat…</p> <p><strong>Affected:</strong> crates.io: deno</p> <p>## Summary</p> <p>A Deno program that opens a client `WebSocket` connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that aborted the entire Deno process.</p> <p>## Details</p> <p>When establishing a client WebSocket connection, Deno read the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers from the server&#39;s `101 Switching Protocols` response and converted them to strings without handling the failure case. `HeaderValue::to_str()` returns an error for any value containing bytes outside the visible-ASCII range, so a header carrying such bytes triggered an unrecoverable error during conversion.</p> <p>Because the client initiates the outbound connection, the handshake response is fully controlled by the server. A server that returns bytes such as `0xFF 0xFE` in either header could therefore crash any client that connected to it.</p> <p>This is purely an availability issue. There is no information disclosure and no memory-safety impact; the only effect is termination of the current process.</p> <p>## Impact</p> <p>Remote denial of service. Any Deno application that establishes WebSocket connections to untrusted or potentially-compromised endpoints could be terminated by the remote peer. Exploitation requires the victim applicat…</p> https://cve.radiocsirt.org/vuln/ghsa-x2qc-cmh9-f4hf