|
31673
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Gemini 3
Fast Answers quickly
Fast
Answers quickly
Thinking Solves complex problems
Thinking
Solves complex problems
Pro Advanced math and code with 3.1 Pro
Pro
Advanced math and code with 3.1 Pro
Get more from Gemini
Get our most capable models & features
Upgrade
Upgrade
Upgrade
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31673
|
|
31674
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Gemini 3
Fast Answers quickly
Fast
Answers quickly
Thinking Solves complex problems
Thinking
Solves complex problems
Pro Advanced math and code with 3.1 Pro
Pro
Advanced math and code with 3.1 Pro
Get more from Gemini
Get our most capable models & features
Upgrade
Upgrade
Upgrade
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
URL
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Source(s)
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
Tag(s)
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31674
|
|
31675
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31675
|
|
31676
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31676
|
|
31677
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31677
|
|
31678
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31678
|
|
31679
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31679
|
|
31680
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31680
|
|
31681
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31681
|
|
31682
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31682
|
|
31683
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31683
|
|
31684
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31684
|
|
31685
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it....
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31685
|
|
31686
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31686
|
|
31687
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31687
|
|
31688
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
Edit
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31688
|
|
31760
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31760
|
|
31761
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31761
|
|
31762
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it
Listen
Show thinking
Gemini said
Gemini said
Dealing with new CVEs can definitely be a hassle, but let's cut through the jargon and break down exactly what this vulnerability is and how to get your systems secured.
What is CVE-2026-23450?
What is CVE-2026-23450?
CVE-2026-23450
is a moderate-severity vulnerability located in the
Linux kernel
, specifically within its
net/smc
(Shared Memory Communications) component.
Here is what is going wrong under the hood:
The Flaw:
There is a "race condition" in the kernel. This happens when an SMC listen socket is being closed at the exact same time it is trying to process incoming TCP connections.
The Mechanism:
Because of this timing mismatch, the kernel gets confused about the state of the socket's memory. This triggers two specific bugs in the
smc_tcp_syn_recv_sock()
function: a
NULL pointer dereference
(looking for data at an empty memory address) and a
Use-After-Free
(trying to use memory that the system has already discarded).
The Impact:
If an attacker intentionally triggers this race condition, it will almost certainly cause a kernel panic and crash the system, resulting in a Denial of Service (DoS). In rare, highly complex scenarios, it could potentially allow for unauthorized code execution.
What Can You Do About It?
What Can You Do About It?
Because this is a kernel-level memory management flaw, mitigating it requires updating your underlying operating system:
Apply Vendor Patches (Highly Recommended):
The standard and most reliable fix is to update your Linux kernel. Major distributions (like Red Hat, Ubuntu, Amazon Linux, etc.) track this CVE and release patched kernel updates through their normal security channels. Running a simple system update via your package manager (like
apt
,
yum
, or
dnf
) and rebooting is usually all it takes.
Audit Your Environment:
Not all environments are vulnerable. For instance, recent security bulletins note that certain Amazon Linux distributions are unaffected, while specific Red Hat Enterprise Linux versions are. You'll want to check your specific OS vendor's security tracker for CVE-2026-23450.
Apply the Upstream Fix:
If you compile custom kernels for your infrastructure, you need to pull the specific git commits referenced in the NVD database. The developers fixed this by implementing Read-Copy-Update (RCU) locking to ensure the system safely pins the memory in place until the socket is fully done with it.
Which Linux distribution and kernel version are you currently running in your environment so we can check if you are actively exposed?
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
URL
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Source(s)
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
Tag(s)
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-ID
CWE Name
Source
Change History
Change History
3 change records found
hide changes
hide changes
CVE Modified by kernel.org 4/27/2026 10:16:33 AM
CVE Modified by kernel.org
4/27/2026 10:16:33 AM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Action
Added
Type
CVSS V3.1
Old Value
New Value
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE Modified by kernel.org 4/18/2026 5:16:27 AM
CVE Modified by kernel.org
4/18/2026 5:16:27 AM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
Action
Added
Type
Reference
Old Value
New Value
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
New CVE Received from kernel.org 4/03/2026 12:16:31 PM
New CVE Received from kernel.org
4/03/2026 12:16:31 PM
Action
Type
Old Value
New Value
Added
Description
Record truncated, showing 2048 of 3132 characters.
View Entire Change Record
View Entire Change Record
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().
This leads to two issues:
1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.
The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):
CPU A (softirq) CPU B (process ctx)
tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!
Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.
Fix this by using RCU and refcount_inc_not_zero(
Added
Reference
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
Added
Reference
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
Added
Reference
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
Added
Reference
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
Added
Reference
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
Added
Reference
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Action
Added
Added
Added
Added
Added
Added
Added
Type
Description
Reference
Reference
Reference
Reference
Reference
Reference
Old Value...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31762
|
|
31763
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it
Listen
Show thinking
Gemini said
Gemini said
Dealing with new CVEs can definitely be a hassle, but let's cut through the jargon and break down exactly what this vulnerability is and how to get your systems secured.
What is CVE-2026-23450?
What is CVE-2026-23450?
CVE-2026-23450
is a moderate-severity vulnerability located in the
Linux kernel
, specifically within its
net/smc
(Shared Memory Communications) component.
Here is what is going wrong under the hood:
The Flaw:
There is a "race condition" in the kernel. This happens when an SMC listen socket is being closed at the exact same time it is trying to process incoming TCP connections.
The Mechanism:
Because of this timing mismatch, the kernel gets confused about the state of the socket's memory. This triggers two specific bugs in the
smc_tcp_syn_recv_sock()
function: a
NULL pointer dereference
(looking for data at an empty memory address) and a
Use-After-Free
(trying to use memory that the system has already discarded).
The Impact:
If an attacker intentionally triggers this race condition, it will almost certainly cause a kernel panic and crash the system, resulting in a Denial of Service (DoS). In rare, highly complex scenarios, it could potentially allow for unauthorized code execution.
What Can You Do About It?
What Can You Do About It?
Because this is a kernel-level memory management flaw, mitigating it requires updating your underlying operating system:
Apply Vendor Patches (Highly Recommended):
The standard and most reliable fix is to update your Linux kernel. Major distributions (like Red Hat, Ubuntu, Amazon Linux, etc.) track this CVE and release patched kernel updates through their normal security channels. Running a simple system update via your package manager (like
apt
,
yum
, or
dnf
) and rebooting is usually all it takes.
Audit Your Environment:
Not all environments are vulnerable. For instance, recent security bulletins note that certain Amazon Linux distributions are unaffected, while specific Red Hat Enterprise Linux versions are. You'll want to check your specific OS vendor's security tracker for CVE-2026-23450.
Apply the Upstream Fix:
If you compile custom kernels for your infrastructure, you need to pull the specific git commits referenced in the NVD database. The developers fixed this by implementing Read-Copy-Update (RCU) locking to ensure the system safely pins the memory in place until the socket is fully done with it.
Which Linux distribution and kernel version are you currently running in your environment so we can check if you are actively exposed?
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
URL
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Source(s)
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
Tag(s)
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-ID
CWE Name
Source
Change History
Change History
3 change records found
hide changes
hide changes
CVE Modified by kernel.org 4/27/2026 10:16:33 AM
CVE Modified by kernel.org
4/27/2026 10:16:33 AM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Action
Added
Type
CVSS V3.1
Old Value
New Value
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE Modified by kernel.org 4/18/2026 5:16:27 AM
CVE Modified by kernel.org
4/18/2026 5:16:27 AM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
Action
Added
Type
Reference
Old Value
New Value
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
New CVE Received from kernel.org 4/03/2026 12:16:31 PM
New CVE Received from kernel.org
4/03/2026 12:16:31 PM
Action
Type
Old Value
New Value
Added
Description
Record truncated, showing 2048 of 3132 characters.
View Entire Change Record
View Entire Change Record
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().
This leads to two issues:
1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.
The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):
CPU A (softirq) CPU B (process ctx)
tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!
Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.
Fix this by using RCU and refcount_inc_not_zero(
Added
Reference
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
Added
Reference
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
Added
Reference
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
Added
Reference
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
Added
Reference
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
Added
Reference
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Action
Added
Added
Added
Added
Added
Added
Added
Type
Description
Reference
Reference
Reference
Reference
Reference
Reference
Old Value
New Value
Record truncated, showing 2048 of 3132 characters.
View Entire Change Record
View Entire Change Record
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().
This leads to two issues:
1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.
The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):
CPU A (softirq) CPU B (process ctx)
tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!
Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.
Fix this by using RCU and refcount_inc_not_zero(
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2026-23450
CVE-2026-23450
NVD Published Date:
04/03/2026
NVD Last Modified:
04/27/2026
Source:
kernel.org
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31763
|
|
31764
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it
Listen
Show thinking
Gemini said
Gemini said
Dealing with new CVEs can definitely be a hassle, but let's cut through the jargon and break down exactly what this vulnerability is and how to get your systems secured.
What is CVE-2026-23450?
What is CVE-2026-23450?
CVE-2026-23450
is a moderate-severity vulnerability located in the
Linux kernel
, specifically within its
net/smc
(Shared Memory Communications) component.
Here is what is going wrong under the hood:
The Flaw:
There is a "race condition" in the kernel. This happens when an SMC listen socket is being closed at the exact same time it is trying to process incoming TCP connections.
The Mechanism:
Because of this timing mismatch, the kernel gets confused about the state of the socket's memory. This triggers two specific bugs in the
smc_tcp_syn_recv_sock()
function: a
NULL pointer dereference
(looking for data at an empty memory address) and a
Use-After-Free
(trying to use memory that the system has already discarded).
The Impact:
If an attacker intentionally triggers this race condition, it will almost certainly cause a kernel panic and crash the system, resulting in a Denial of Service (DoS). In rare, highly complex scenarios, it could potentially allow for unauthorized code execution.
What Can You Do About It?
What Can You Do About It?
Because this is a kernel-level memory management flaw, mitigating it requires updating your underlying operating system:
Apply Vendor Patches (Highly Recommended):
The standard and most reliable fix is to update your Linux kernel. Major distributions (like Red Hat, Ubuntu, Amazon Linux, etc.) track this CVE and release patched kernel updates through their normal security channels. Running a simple system update via your package manager (like
apt
,
yum
, or
dnf
) and rebooting is usually all it takes.
Audit Your Environment:
Not all environments are vulnerable. For instance, recent security bulletins note that certain Amazon Linux distributions are unaffected, while specific Red Hat Enterprise Linux versions are. You'll want to check your specific OS vendor's security tracker for CVE-2026-23450.
Apply the Upstream Fix:
If you compile custom kernels for your infrastructure, you need to pull the specific git commits referenced in the NVD database. The developers fixed this by implementing Read-Copy-Update (RCU) locking to ensure the system safely pins the memory in place until the socket is fully done with it.
Which Linux distribution and kernel version are you currently running in your environment so we can check if you are actively exposed?
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31764
|
|
31765
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it
Listen
Show thinking
Gemini said
Gemini said
Dealing with new CVEs can definitely be a hassle, but let's cut through the jargon and break down exactly what this vulnerability is and how to get your systems secured.
What is CVE-2026-23450?
What is CVE-2026-23450?
CVE-2026-23450
is a moderate-severity vulnerability located in the
Linux kernel
, specifically within its
net/smc
(Shared Memory Communications) component.
Here is what is going wrong under the hood:
The Flaw:
There is a "race condition" in the kernel. This happens when an SMC listen socket is being closed at the exact same time it is trying to process incoming TCP connections.
The Mechanism:
Because of this timing mismatch, the kernel gets confused about the state of the socket's memory. This triggers two specific bugs in the
smc_tcp_syn_recv_sock()
function: a
NULL pointer dereference
(looking for data at an empty memory address) and a
Use-After-Free
(trying to use memory that the system has already discarded).
The Impact:
If an attacker intentionally triggers this race condition, it will almost certainly cause a kernel panic and crash the system, resulting in a Denial of Service (DoS). In rare, highly complex scenarios, it could potentially allow for unauthorized code execution.
What Can You Do About It?
What Can You Do About It?
Because this is a kernel-level memory management flaw, mitigating it requires updating your underlying operating system:
Apply Vendor Patches (Highly Recommended):
The standard and most reliable fix is to update your Linux kernel. Major distributions (like Red Hat, Ubuntu, Amazon Linux, etc.) track this CVE and release patched kernel updates through their normal security channels. Running a simple system update via your package manager (like
apt
,
yum
, or
dnf
) and rebooting is usually all it takes.
Audit Your Environment:
Not all environments are vulnerable. For instance, recent security bulletins note that certain Amazon Linux distributions are unaffected, while specific Red Hat Enterprise Linux versions are. You'll want to check your specific OS vendor's security tracker for CVE-2026-23450.
Apply the Upstream Fix:
If you compile custom kernels for your infrastructure, you need to pull the specific git commits referenced in the NVD database. The developers fixed this by implementing Read-Copy-Update (RCU) locking to ensure the system safely pins the memory in place until the socket is fully done with it.
Which Linux distribution and kernel version are you currently running in your environment so we can check if you are actively exposed?
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31765
|
|
31766
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-23450
NVD - cve-2026-23450
Close tab
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 kernel.org https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd kernel.org https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 kernel.org https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 kernel.org https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 kernel.org https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275 kernel.org https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 kernel.org Change History 3 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-23450</tabTitle>” with “<selection>References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
Change History
3 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of NVD CVE-2026-23450 References
Summary of NVD CVE-2026-23450 References
The selected text provides external references and official disclaimers regarding the vulnerability
CVE-2026-23450
.
NIST Disclaimer
NIST Disclaimer
External Links:
Links lead to non-NIST websites for informational purposes.
Endorsement:
NIST does not endorse the views, facts, or commercial products found on these external sites.
Feedback:
Comments regarding the NVD page should be directed to
[EMAIL]
.
Reference Links
Reference Links
The following source code commits from
kernel.org
are provided as technical references or solutions:
Commit 1e4f873
Commit 1e4f873
Commit 1fab5ec
Commit 1fab5ec
Commit 6d5e453
Commit 6d5e453
Commit cadf3da
Commit cadf3da
Commit f00fc26
Commit f00fc26
Commit f315277
Commit f315277
Commit fd7579f
Commit fd7579f
Change History
Change History
There are
3 change records
available for this CVE entry.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
Edit
You said what is is and what can I do about it
You said
what is is and what can I do about it
Listen
Show thinking
Gemini said
Gemini said
Dealing with new CVEs can definitely be a hassle, but let's cut through the jargon and break down exactly what this vulnerability is and how to get your systems secured.
What is CVE-2026-23450?
What is CVE-2026-23450?
CVE-2026-23450
is a moderate-severity vulnerability located in the
Linux kernel
, specifically within its
net/smc
(Shared Memory Communications) component.
Here is what is going wrong under the hood:
The Flaw:
There is a "race condition" in the kernel. This happens when an SMC listen socket is being closed at the exact same time it is trying to process incoming TCP connections.
The Mechanism:
Because of this timing mismatch, the kernel gets confused about the state of the socket's memory. This triggers two specific bugs in the
smc_tcp_syn_recv_sock()
function: a
NULL pointer dereference
(looking for data at an empty memory address) and a
Use-After-Free
(trying to use memory that the system has already discarded).
The Impact:
If an attacker intentionally triggers this race condition, it will almost certainly cause a kernel panic and crash the system, resulting in a Denial of Service (DoS). In rare, highly complex scenarios, it could potentially allow for unauthorized code execution.
What Can You Do About It?
What Can You Do About It?
Because this is a kernel-level memory management flaw, mitigating it requires updating your underlying operating system:
Apply Vendor Patches (Highly Recommended):
The standard and most reliable fix is to update your Linux kernel. Major distributions (like Red Hat, Ubuntu, Amazon Linux, etc.) track this CVE and release patched kernel updates through their normal security channels. Running a simple system update via your package manager (like
apt
,
yum
, or
dnf
) and rebooting is usually all it takes.
Audit Your Environment:
Not all environments are vulnerable. For instance, recent security bulletins note that certain Amazon Linux distributions are unaffected, while specific Red Hat Enterprise Linux versions are. You'll want to check your specific OS vendor's security tracker for CVE-2026-23450.
Apply the Upstream Fix:
If you compile custom kernels for your infrastructure, you need to pull the specific git commits referenced in the NVD database. The developers fixed this by implementing Read-Copy-Update (RCU) locking to ensure the system safely pins the memory in place until the socket is fully done with it.
Which Linux distribution and kernel version are you currently running in your environment so we can check if you are actively exposed?
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-23450 Detail
CVE-2026-23450
Detail
AWAITING ENRICHMENT
This CVE record has been marked for NVD enrichment efforts.
Description
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
CNA:
kernel.org
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
kernel.org
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
kernel.org
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
kernel.org
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
kernel.org
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
kernel.org
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
kernel.org
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
kernel.org
URL
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Source(s)
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
kernel.org
Tag(s)
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-ID
CWE Name
Source
Change History
Change History
3 change records found
hide changes
hide changes
CVE Modified by kernel.org 4/27/2026 10:16:33 AM
CVE Modified by kernel.org
4/27/2026 10:16:33 AM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Action
Added
Type
CVSS V3.1
Old Value
New Value
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE Modified by kernel.org 4/18/2026 5:16:27 AM
CVE Modified by kernel.org
4/18/2026 5:16:27 AM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
Action
Added
Type
Reference
Old Value
New Value
https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275
New CVE Received from kernel.org 4/03/2026 12:16:31 PM
New CVE Received from kernel.org
4/03/2026 12:16:31 PM
Action
Type
Old Value
New Value
Added
Description
Record truncated, showing 2048 of 3132 characters.
View Entire Change Record
View Entire Change Record
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().
This leads to two issues:
1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.
The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):
CPU A (softirq) CPU B (process ctx)
tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!
Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.
Fix this by using RCU and refcount_inc_not_zero(
Added
Reference
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
Added
Reference
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
Added
Reference
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
Added
Reference
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
Added
Reference
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
Added
Reference
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
Action...
|
Firefox
|
NVD - cve-2026-23450 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-23450
|
31766
|
|
32569
|
[JY-19967] Upgrade Python and libraries - Apr - Ji [JY-19967] Upgrade Python and libraries - Apr - Jira
[JY-19967] Upgrade Python and libraries - Apr - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Vanta Agent
Product updates
Comments & activity
Settings
Lukas Kovalik
Help - command K
Help...
⌘+K
Home
Home
My work
My work
Vanta Agent
Vanta Agent
Tests
Tests
Reports
Reports
Compliance
Compliance
Customer trust
Customer trust
Risk
Risk
Vendors
Vendors
Assets
Assets
Inventory
Inventory
Code changes
Code changes
Vulnerabilities
Vulnerabilities
Security alerts
Security alerts
Personnel
Personnel
Integrations
Integrations
My security tasks
My security tasks
My access requests
My access requests
Collapse
Findings by asset
Findings by asset
/
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code
Configure image scan
Configure image scan
Refresh
Refresh
Amazon Web Services (AWS)
Findings by asset
Findings by asset
Findings by vulnerability
Findings by vulnerability
Deactivated
Deactivated
History
History
Search
Source
Source
Severity
Severity
Select all rows
PACKAGE
SOURCES
VULNERABILITIES
SCORE
SEVERITY
DUE DATE
Select row 1
linux:6.1.164
339 vulnerabilities
9.8
Critical
Due in 14 days
Select row 2
php/php:8.3.30
8 vulnerabilities
—
Critical
Due in 14 days
Select row 3
glibc:2.36
6 vulnerabilities
8.4
High
Due in 30 days
Select row 4
dpkg:1.21.22
2 vulnerabilities
8.2
High
Due in 30 days
Select row 5
phpunit/phpunit:9.6.8
CVE-2026-24765
7.8
High
Due in 30 days
Select row 6
phpunit/phpunit:8.5.21
CVE-2026-24765
7.8
High
Due in 30 days
Select row 7
phpunit/phpunit:5.7.27
CVE-2026-24765
7.8
High
Due in 30 days
Select row 8
phpunit/phpunit:4.8.36
CVE-2026-24765
7.8
High
Due in 30 days
Select row 9
phpunit/phpunit:4.4.2
CVE-2026-24765
7.8
High
Due in 30 days
Select row 10
python3.11:3.11.2
7 vulnerabilities
7.5
High
Due in 30 days
Select row 11
nghttp2:1.52.0
CVE-2026-27135
7.5
High
Due in 30 days
Select row 12
libxml2:2.9.14+dfsg
CVE-2026-6732
7.5
High
Due in 30 days
Select row 13
libde265:1.0.11
2 vulnerabilities
7.5
High
Due in 30 days
Select row 14
lcms2:2.14
CVE-2026-41254
7.5
High
Due in 30 days
Select row 15
libcap2:2.66
CVE-2026-4878
7
High
Due in 30 days
Select row 16
systemd:252.39
4 vulnerabilities
6.7
Medium
Due in about 1 month
Select row 17
libgcrypt20:1.10.1
CVE-2026-41989
6.7
Medium
Due in about 1 month
Select row 18
curl:7.88.1
4 vulnerabilities
6.5
Medium
Due in about 1 month
Select row 19
jq:1.6
4 vulnerabilities
6.2
Medium
Due in about 1 month
Select row 20
request:2.88.2
CVE-2023-28155
6.1
Medium
Due in about 1 month
Select all rows
Select row 1
Select row 2
Select row 3
Select row 4
Select row 5
Select row 6
Select row 7
Select row 8
Select row 9
Select row 10
Select row 11
Select row 12
Select row 13
Select row 14
Select row 15
Select row 16
Select row 17
Select row 18...
|
Firefox
|
jiminny/app/backend-code - Vanta — Work
|
nvd.nist.gov/vuln/detail/cve-2026-0861
|
32569
|
|
32570
|
[JY-19967] Upgrade Python and libraries - Apr - Ji [JY-19967] Upgrade Python and libraries - Apr - Jira
[JY-19967] Upgrade Python and libraries - Apr - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-0861
NVD - cve-2026-0861
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Waiting for nvd.nist.gov…...
|
Firefox
|
NVD - cve-2026-0861 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-0861
|
32570
|
|
32571
|
[JY-19967] Upgrade Python and libraries - Apr - Ji [JY-19967] Upgrade Python and libraries - Apr - Jira
[JY-19967] Upgrade Python and libraries - Apr - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-0861
NVD - cve-2026-0861
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-0861 Detail
CVE-2026-0861
Detail
Description
Description
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
ADP:
CISA-ADP
Base Score:
8.4 HIGH
8.4 HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
http://www.openwall.com/lists/oss-security/2026/01/16/5
http://www.openwall.com/lists/oss-security/2026/01/16/5
CVE
Mailing List
Patch
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
GNU C Library
Exploit
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
GNU C Library
Patch
URL
http://www.openwall.com/lists/oss-security/2026/01/16/5
http://www.openwall.com/lists/oss-security/2026/01/16/5
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
Source(s)
CVE
GNU C Library
GNU C Library
Tag(s)
Mailing List
Patch
Exploit
Patch
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-190
CWE-190
Integer Overflow or Wraparound
GNU C Library
CWE-ID
CWE-190
CWE-190
CWE Name
Integer Overflow or Wraparound
Source
GNU C Library
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
2.30
Up to (including)
2.42
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
5 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2026-0861
CVE-2026-0861
NVD Published Date:
01/14/2026
NVD Last Modified:
02/03/2026
Source:
GNU C Library
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2026-0861 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-0861
|
32571
|
|
32572
|
[JY-19967] Upgrade Python and libraries - Apr - Ji [JY-19967] Upgrade Python and libraries - Apr - Jira
[JY-19967] Upgrade Python and libraries - Apr - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-0861
NVD - cve-2026-0861
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2026-0861 Detail
CVE-2026-0861
Detail
Description
Description
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
N/A
NVD assessment not yet provided.
ADP:
CISA-ADP
Base Score:
8.4 HIGH
8.4 HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
http://www.openwall.com/lists/oss-security/2026/01/16/5
http://www.openwall.com/lists/oss-security/2026/01/16/5
CVE
Mailing List
Patch
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
GNU C Library
Exploit
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
GNU C Library
Patch
URL
http://www.openwall.com/lists/oss-security/2026/01/16/5
http://www.openwall.com/lists/oss-security/2026/01/16/5
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/bugzilla/show_bug.cgi?id=33796
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001
Source(s)
CVE
GNU C Library
GNU C Library
Tag(s)
Mailing List
Patch
Exploit
Patch
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-190
CWE-190
Integer Overflow or Wraparound
GNU C Library
CWE-ID
CWE-190
CWE-190
CWE Name
Integer Overflow or Wraparound
Source
GNU C Library
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
2.30
Up to (including)
2.42
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
....
|
Firefox
|
NVD - cve-2026-0861 — Work
|
nvd.nist.gov/vuln/detail/cve-2026-0861
|
32572
|
|
31519
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Vanta Agent
Product updates
Comments & activity
Settings
Lukas Kovalik
Help - command K
Help...
⌘+K
Home
Home
My work
My work
Vanta Agent
Vanta Agent
Tests
Tests
Reports
Reports
Compliance
Compliance
Customer trust
Customer trust
Risk
Risk
Vendors
Vendors
Assets
Assets
Inventory
Inventory
Code changes
Code changes
Vulnerabilities
Vulnerabilities
Security alerts
Security alerts
Personnel
Personnel
Integrations
Integrations
My security tasks
My security tasks
My access requests
My access requests
Collapse
Findings by asset
Findings by asset
/
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code...
|
Firefox
|
jiminny/app/backend-code - Vanta — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31519
|
|
31520
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Vanta Agent
Product updates
Comments & activity
Settings
Lukas Kovalik
Help - command K
Help...
⌘+K
Home
Home
My work
My work
Vanta Agent
Vanta Agent
Tests
Tests
Reports
Reports
Compliance
Compliance
Customer trust
Customer trust
Risk
Risk
Vendors
Vendors
Assets
Assets
Inventory
Inventory
Code changes
Code changes
Vulnerabilities
Vulnerabilities
Security alerts
Security alerts
Personnel
Personnel
Integrations
Integrations
My security tasks
My security tasks
My access requests
My access requests
Collapse
Findings by asset...
|
Firefox
|
jiminny/app/backend-code - Vanta — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31520
|
|
31521
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Transferring data from nvd.nist.gov…...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31521
|
|
31522
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31522
|
|
31523
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31523
|
|
31524
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31524
|
|
31525
|
Platform Team - Backlog - Jira
Platform Team - Bac Platform Team - Backlog - Jira
Platform Team - Backlog - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
31525
|
|
77260
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)...
|
Firefox
|
jiminny/app/backend-code - Vanta — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77260
|
|
77261
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Vanta Agent
Product updates
Comments & activity
Settings
Lukas Kovalik
Help - command K
Help...
⌘+K
Home
Home
My work
My work
Vanta Agent
Vanta Agent
Tests
Tests
Reports
Reports
Compliance
Compliance
Customer trust
Customer trust
Risk
Risk
Vendors
Vendors
Assets
Assets
Inventory
Inventory
Code changes
Code changes
Vulnerabilities
Vulnerabilities
Security alerts
Security alerts
Personnel
Personnel
Integrations
Integrations
My security tasks
My security tasks
My access requests
My access requests
Collapse
Findings by asset
Findings by asset
/
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code
jiminny/app/backend-code
Configure image scan
Configure image scan
Refresh
Refresh
Amazon Web Services (AWS)
Findings by asset
Findings by asset
Findings by vulnerability
Findings by vulnerability
Deactivated
Deactivated
History
History
Search
Source
Source
Severity
Severity
Select all rows
PACKAGE
SOURCES
VULNERABILITIES
SCORE
SEVERITY
DUE DATE
Select row 1
php/php:8.5.5
10 vulnerabilities
9.8
Critical
Due in 14 days
Select row 2
linux:6.1.164
1173 vulnerabilities
9.8
Critical
Due in 14 days
Select row 3
gnutls28:3.7.9
6 vulnerabilities
9.8
Critical
Due in 14 days
Select row 4
libheif:1.15.1
7 vulnerabilities
8.8...
|
Firefox
|
jiminny/app/backend-code - Vanta — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77261
|
|
77262
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77262
|
|
77263
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77263
|
|
77264
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77264
|
|
77268
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77268
|
|
77269
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77269
|
|
77270
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77270
|
|
77271
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77271
|
|
77272
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77272
|
|
77273
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77273
|
|
77274
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77274
|
|
77277
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77277
|
|
77278
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77278
|
|
77279
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77279
|
|
77286
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77286
|