Security vulnerabilities and automated fixes for message integrity issues
2 posts found
CVE-2026-54466 is a critical vulnerability in websocket-driver 0.7.4 that allows attackers to corrupt WebSocket messages by abusing protocol length headers. The fix upgrades the package to version 0.7.5, which implements proper validation of untrusted length header inputs. This vulnerability could allow attackers to modify or inject data into real-time communication channels used by frontend applications.
A medium-severity vulnerability in `daemon/src/odl_tb5_daemon_sync_proto.c` allowed any network entity that could reach the daemon's listening port to send crafted sync protocol messages without any authentication challenge. The fix introduces HMAC-SHA256 message authentication tags stamped directly into the sync header's reserved field, ensuring that only peers with the correct pre-shared key can send messages that the daemon will accept. This closes a significant attack surface that could have