00Xc

**Name of the Vulnerable Software and Affected Versions** libebml versions prior to 1.4.5 **Description** The issue is related to an integer overflow in the MemIOCallback.cpp file of the libebml library. This overflow can occur during reading or writing operations and may result in buffer overflows. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For versions prior to 1.4.5, update to version 1.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the MemIOCallback.cpp file or limiting the operations that can be performed on it until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** odoh-rs (affected versions not specified) **Description** A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable. **Recommendations** Update the odoh-rs rust crate to v1.0.2. As a temporary workaround, consider restricting access to the encrypted query parsing functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** github.com/cloudflare/cfnts versions prior to commit 783490b **Description** The issue is related to an unchecked read in the NTP server, which allows a remote attacker to trigger a panic by sending an NTSAuthenticator packet with an extension length longer than the packet contents. **Recommendations** For versions prior to commit 783490b, update to a version that includes the fix for this issue, specifically commit 783490b or later. As a temporary workaround, consider restricting access to the NTP server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** lua-resty-json versions up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a **Description** A debug function in the lua-resty-json package contained an out of bounds access bug that could have allowed an attacker to launch a Denial of Service (DoS) if the function was used to parse untrusted input data. The debug function was only used in tests and demos, making it not exploitable in a normal environment. **Recommendations** For versions up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a, consider disabling the debug function to prevent potential exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** xml-rs versions 0.8.9 through 0.8.13 **Description** The issue allows for a denial of service (panic) via an invalid <! token, such as <!DOCTYPEs/%<!A nesting, in an XML document. **Recommendations** For xml-rs versions 0.8.9 through 0.8.13, update to version 0.8.14 or later to resolve the issue.