AI and data stack advisories

Critical this month46Projects282

46 critical this month · 282 projects

CloudflareGHSA-c3x7-354f-4p2x

lol-html panics on certain HTML inputs

Cloudflare

CVE-2023-4241 · Published Aug 8, 2023

High7.5
Fix: upgrade to 1.1.1 or later
GitHub advisory

Impact

lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

Patches

The problem has been patched and released as v1.1.1

Workarounds

No workarounds exist.

Affected versions

PackageAffectedFixed in
lol-html
crates.io
< 1.1.11.1.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)

More Cloudflare advisories

All Cloudflare
CVE-2023-6193Dec 12, 2023Unbounded queuing of path validation messages in cloudflare-quicheMedium5.3Fixed in 0.19.1CVE-2023-6180Dec 5, 2023Resource exhaustion via memory leak in tokio-boringMedium5.3Fixed in 4.1.0CVE-2023-48230Nov 21, 2023WebSocket message can cause crashMediumFixed in v1.20231121.0CVE-2023-3348Aug 3, 2023Directory traversal vulnerability in Cloudflare WranglerMedium5.7Fixed in 3.1.1 +1CVE-2023-2512May 12, 2023Buffer under-read in workerdMedium6.5Fixed in v1.20230419.0CVE-2023-1732May 10, 2023Improper random reading in CIRCLMedium5.3Fixed in 1.3.3