GHSA-6jp5-grgh-jw42

Source

https://github.com/advisories/GHSA-6jp5-grgh-jw42

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-6jp5-grgh-jw42/GHSA-6jp5-grgh-jw42.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6jp5-grgh-jw42

Aliases

Published

2026-02-04T20:47:37Z

Modified

2026-02-05T03:56:07.902243Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator

Summary

EVE Freely Allocates Buffer on The Stack With Data From Socket

Details

Impact

VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service.

An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service.

Patches

Fixed in 9.4.3-lts and 10.1.0

Workarounds

None

Database specific

{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-770",
        "CWE-789"
    ],
    "github_reviewed_at": "2026-02-04T20:47:37Z"
}

References

Affected packages

Go / github.com/lf-edge/eve

Package

Name: github.com/lf-edge/eve; View open source insights on deps.dev
Purl: pkg:golang/github.com/lf-edge/eve

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20230519072751-977f42b07fa9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-6jp5-grgh-jw42/GHSA-6jp5-grgh-jw42.json"