Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Direct ClassLoader.getResources lookup for deserialization configuration files (e.g., 'META-INF/helidon/serial-config.properties') can lead to missing filter rules when packaged in single/fat JARs due to resource path collisions. Use MetadataDiscovery to aggregate metadata instead.
Direct ClassLoader resource lookup for serial-config.properties can fail to locate deserialization filters in single-jar deployments. Use MetadataDiscovery instead.
Loading serialization filter properties via ClassLoader.getResources() does not support single-jar/fat-jar metadata discovery in Helidon, which can lead to omitted JEP 290 filter configurations.
Insecure deserialization filter configuration loading via static ClassLoader resources in single-jar environments.
Incomplete JEP 290 deserialization filter discovery in fat-jar deployments.
Serialization filter configuration is loaded directly via ClassLoader.getResources with a fixed path, which can cause module configuration collisions and lost deserialization filter rules in fat JARs.
Loading serialization filter configurations directly via ClassLoader.getResources may fail to discover all module-level filters in single-JAR or shaded deployments. Use Helidon's MetadataDiscovery API instead.
A weak lexical guard against path traversal was detected. Splitting a path string and checking for literal '..' components can be bypassed by URL-encoded sequences, normalization differences, or symlink traversal. Prefer using secure path resolution methods like `os.path.abspath(path).startswith(required_root)` or `pathlib.Path.resolve()` to safely validate
Two consecutive `.assign()` operations on the same object were detected. The second `.assign()` overwrites the string instead of appending to it, which causes the data from the first assignment to be silently discarded. When manipulating buffers or parsing input, this can drop critical tokens such as line breaks, leading to parser differentials and potential
Incomplete URI host validation. Validating only ASCII control characters without rejecting authority delimiters ('/', '?', '#', '@', '\\') can lead to host confusion, SSRF, or HTTP header injection.
Directly slicing `url.pathname` with a dynamically calculated index length can result in arbitrary path truncation when requests contain percent-encoded multibyte characters. Because multi-byte characters require more string characters when percent-encoded, a length calculated from a decoded representation will misalign with the encoded representation, causi
Affirmative use of createRouteMatcher — `if ($MATCHER(req)) { await auth.protect(); }` — is the vulnerable shape for CVE-2026-41248. In @clerk/shared versions before 2.22.1 / 3.47.4 / 4.8.1 the matcher compared the raw pathname without URL normalization, so crafted requests (`/api/%61dmin/...`, `//api/admin/...`, `/api/foo/%2e%2e/admin/...`) skipped the matc
A chunk discard path in the push-mode parser clears the PNG_HAVE_CHUNK_HEADER state without calling png_crc_finish() or consuming the chunk payload. This leaves raw unconsumed bytes in the stream, parsing them as a new chunk on the next iteration and enabling chunk smuggling. Ensure the chunk body and CRC are consumed before clearing the state flag.
A tar parser checks if the base header size is zero before applying the PAX extended header size override. This causes an interpretation conflict (parser differential) with tools that unconditionally respect the PAX size override, which can be manipulated to conceal malicious entries. The PAX size, if present, should unconditionally override the base size.
Silently skipping malformed PAX extensions by using `filter_map(|f| f.ok())` can conceal parsing errors and lead to parser differentials. This behavior can be exploited if a subsequent component interprets the skipped malformed extension differently. Propagate the error using `?` or handle it explicitly instead of suppressing it.
Decoding a request path or URL using `decodeURIComponent` can introduce a path confusion vulnerability. `decodeURIComponent` decodes percent-encoded slashes (`%2F`) into literal slashes (`/`), whereas most application routers use `decodeURI`, which leaves them encoded. This discrepancy can allow an attacker to bypass route-based middleware protections (e.g.,
Calling `SkipClean(true)` on a `gorilla/mux` router disables automatic URL path cleaning. This allows unnormalized path payloads (like using multiple consecutive slashes) to bypass path-based access control, routing, or authorization rules that rely on normalized paths. If the underlying filesystem or downstream service subsequently cleans the path, an attac
Reassigning a raw, undecoded URL to the request object in a framework integration may create a parsing differential routing bypass if downstream routers expect a decoded path but native handlers decode it independently.
A validator is being registered or created inside the `initializeFormElement()` lifecycle hook. At this stage in the TYPO3 Form lifecycle, concrete form definition properties (such as `allowedMimeTypes`) have not yet been applied. This causes the validator to use default or incomplete data, completely bypassing intended security restrictions like server-side
Extracting paths from URLs using fixed character offsets based on assumptions about scheme lengths can lead to interpretation conflicts and path confusion. Malformed URIs might cause the extractor to yield an incorrect path, potentially bypassing upstream proxy path-based ACLs. Use a dynamically calculated offset based on a protocol separator (e.g., `url.ind
Extracting trusted SAML assertion fields via REXML::XPath while binding the `id` XPath variable to `signed_element_id` (e.g. `REXML::XPath.first(doc, "/p:Response/a:Assertion[@ID=$id]...", { ..., "id" => doc_to_validate.signed_element_id })`) is vulnerable to XML Signature Wrapping (CVE-2025-25292 / GHSL-2024-330). Nokogiri (used for canonicalization/signatu
SAML signature-validation pipeline re-queries the raw XML document with REXML::XPath using `signed_element_id` as the `@ID` lookup variable to fetch downstream identity content (NameID, Attributes, Subject, etc.). The cryptographic signature was verified by Nokogiri on a (potentially) different document tree; trusting REXML's ID-based lookup on the raw docum
Extracting path identifiers directly from `req.url` using string manipulation methods like `substring` or `slice` can lead to path confusion vulnerabilities. `req.url` includes the query string, meaning appended query parameters will be included in the extracted string. If downstream logic uses `req.path` or otherwise strips the query string, this discrepanc
A permissive regular expression is used to validate IPv4 octets. By not restricting leading zeros, standard network parsers may treat the octet as octal while this validation treats it as decimal. This interpretation conflict can lead to SSRF or access control bypasses. Ensure that IPv4 octets with leading zeros are explicitly rejected or properly validated
