更新: 2423 个文件 - 2026-03-18 14:23:01

08-threat-intel/registry/advisories/sveltekit--GHSA-vrhm-gvg7-fpcf.json

@@ -0,0 +1,71 @@
+{
+  "canonical_id": "sveltekit--GHSA-vrhm-gvg7-fpcf",
+  "system_id": "sveltekit",
+  "display_name": "SvelteKit",
+  "category": "frameworks",
+  "advisory_mode": "core",
+  "title": " Memory exhaustion in SvelteKit remote form deserialization (experimental only)",
+  "summary": "Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.\n\nOnly applications using both `experimental.remoteFunctions` and `form` are vulnerable.",
+  "published_at": "2026-02-19T20:29:42Z",
+  "updated_at": "2026-02-22T23:25:49.392878Z",
+  "severity": "medium",
+  "cvss_score": 4.0,
+  "exploit_status": "unknown",
+  "source_confidence": "official",
+  "official_source_url": "https://github.com/sveltejs/kit/security/advisories/GHSA-vrhm-gvg7-fpcf",
+  "secondary_source_urls": [
+    "https://github.com/sveltejs/kit/commit/f47c01bd8100328c24fdb8522fe35913b0735f35",
+    "https://github.com/sveltejs/kit",
+    "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.52.2"
+  ],
+  "aliases": [
+    "GHSA-vrhm-gvg7-fpcf"
+  ],
+  "cve_ids": [],
+  "ghsa_ids": [
+    "GHSA-vrhm-gvg7-fpcf"
+  ],
+  "osv_ids": [
+    "GHSA-vrhm-gvg7-fpcf"
+  ],
+  "affected_versions": [
+    "introduced=2.49.0, fixed<2.52.2"
+  ],
+  "fixed_versions": [
+    "2.52.2"
+  ],
+  "package_name": "@sveltejs/kit",
+  "render_markdown": true,
+  "case_path": "07-framework-security/frameworks/sveltekit/cases/sveltekit-ghsa-vrhm-gvg7-fpcf.md",
+  "secure_code_topics": [
+    "authz-server-side-recheck",
+    "token-cookie-storage",
+    "deserialization-safety"
+  ],
+  "status": "generated",
+  "triage_reasons": [],
+  "verification_status": "triage-manual",
+  "verification_mode": "synthetic",
+  "last_verified_at": null,
+  "last_run_id": null,
+  "evidence_bundle": null,
+  "historical_status": null,
+  "latest_status": null,
+  "browser_evidence": {
+    "required": false,
+    "present": false,
+    "refs": []
+  },
+  "repro_profile_id": "deserialization-generic",
+  "artifact_mode": "synthetic",
+  "blocked_reason": null,
+  "metadata": {
+    "source_names": [
+      "OSV SvelteKit"
+    ],
+    "source_kinds": [
+      "osv-batch"
+    ],
+    "candidate_count": 1
+  }
+}