Snyk Security Database

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the customDecodeURIComponent function, which uses a quadratic replacement loop over percent-encoded runs. An attacker can supply a large input string containing many distinct percent-encoded sequences followed by a malformed token (e.g. %zz) to force the fallback decoder path, causing the replacement loop to iterate over an ever-growing replace map and take exponential time - approximately 20 seconds for a ~224 KB payload.

modoboa is a Mail hosting made simple

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via multiple API viewsets and serializers, where authorization checks are missing or insufficient. In the alarm bulk-delete endpoint, models.Alarm.objects.filter() is called directly instead of self.get_queryset(), allowing an authenticated user to delete alarms belonging to other users. In the autoreply serializer, the mbox field is not validated against the requesting user's mailbox, allowing a user to create or modify autoreply messages for mailboxes they do not own. In the calendars viewset, a user can access events from calendars that do not belong to them.

Affected versions of this package are vulnerable to Out-of-bounds Write (HTTP2Shell) via block-switch handling in the Brotli decoder, specifically DecodeBlockTypeAndLength in deps/brotli/c/dec/decode.c. An attacker can execute arbitrary code by supplying a crafted Brotli-compressed stream with an invalid block switch to the code that decodes it; the decoder fails to propagate the block-switch error during command processing, allowing the out-of-bounds write.