Snyk Security Database

exifreader is a Library that parses Exif metadata in images.

Affected versions of this package are vulnerable to Infinite loop via a malformed ISO-BMFF iloc box in HEIC/AVIF files, parsed by parseItemLocationBox in src/image-header-iso-bmff-iloc.js. When the declared extentCount field in an iloc box is set to an arbitrarily large value, the parser allocates memory proportional to that declared count rather than the actual available input, causing excessive memory allocation and crashing the process.

crossbar is a Crossbar.io multi-protocol (WAMP/WebSocket, REST/HTTP, MQTT) application router for microservices.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the maxMessagePayloadSize limit is enforced against the compressed wire size of a permessage-compressed WebSocket frame rather than the uncompressed (inflated) application-level payload. An attacker can send a small compressed WebSocket frame that inflates far beyond the configured limit, bypassing the size check and delivering an oversized payload to the application, which can crash or exhaust resources in the receiving process.

org.jboss.resteasy:resteasy-core is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java.

Affected versions of this package are vulnerable to Data Amplification in the readFrom() method of IIOImageProvider, which passes the request body to IIOImageProviderHelper.readImage() and on to ImageReader.readAll(imageIndex, null) with no dimension or pixel-count check and no size limit. An attacker can exhaust the heap from a tiny request by submitting an image whose header declares enormous dimensions, such as a 68-byte PNG declaring 20,000x20,000 pixels, which drives an allocation attempt of roughly 1.6 GB before any decoding completes. This requires an endpoint that accepts IIOImage input under an image/* content type.