HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCrowcpp Crow
APPCrowcpp1.0\+4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2022-38667CRITICAL9.8PL ✓same product
Use-After-Free w Crow (CrowCpp) przy HTTP pipelining — możliwy RCE
CVE-2022-34970CRITICAL9.8PL ✓same product
Heap-based buffer overflow w Crow (RCE) przez funkcję qs_parse
CVE-2023-26142MEDIUM6.5same product
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used t...
CVE-2021-23514MEDIUM6.5same product
This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files fr...
CVE-2021-23824MEDIUM6.5same product
This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker ...