[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2025-11187":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":37,"duplicate_of":9,"upstream":48,"downstream":49,"duplicates":84,"related":85,"reserved_at":9,"published_at":98,"modified_at":99,"state":100,"summary":101,"references_raw":109,"kevs":156,"epss":157,"epss_history":160,"metrics":423,"affected":439},"CVE-2025-11187","Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation\nwhich can trigger a stack-based buffer overflow, invalid pointer or NULL\npointer dereference during MAC verification.\n\nImpact summary: The stack buffer overflow or NULL pointer dereference may\ncause a crash leading to Denial of Service for an application that parses\nuntrusted PKCS#12 files. The buffer overflow may also potentially enable\ncode execution depending on platform mitigations.\n\nWhen verifying a PKCS#12 file that uses PBMAC1 for the MAC, the PBKDF2\nsalt and keylength parameters from the file are used without validation.\nIf the value of keylength exceeds the size of the fixed stack buffer used\nfor the derived key (64 bytes), the key derivation will overflow the buffer.\nThe overflow length is attacker-controlled. Also, if the salt parameter is\nnot an OCTET STRING type this can lead to invalid or NULL pointer\ndereference.\n\nExploiting this issue requires a user or application to process\na maliciously crafted PKCS#12 file. It is uncommon to accept untrusted\nPKCS#12 files in applications as they are usually used to store private\nkeys which are trusted by definition. For this reason the issue was assessed\nas Moderate severity.\n\nThe FIPS modules in 3.6, 3.5 and 3.4 are not affected by this issue, as\nPKCS#12 processing is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5 and 3.4 are vulnerable to this issue.\n\nOpenSSL 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue as they do\nnot support PBMAC1 in PKCS#12.",null,[11,20],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-476","NULL Pointer Dereference","The product dereferences a pointer that it expects to be valid but is NULL.","weakness","Stable","Base","Medium",[],{"_key":21,"id":21,"name":22,"description":23,"type":15,"status":24,"abstraction":17,"likelihood_of_exploit":25,"capec":26},"CWE-787","Out-of-bounds Write","The product writes data past the end, or before the beginning, of the intended buffer.","Draft","High",[],[28],{"_key":29,"name":30,"source":31,"url":32,"maturity":33,"reliability_score":34,"verified":35,"type":9,"platforms":36,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_METADUST_CVE-2025-11187","Cve 2025 11187","github","https://github.com/metadust/CVE-2025-11187","poc",0.3,false,[],[38,39,40,41,42,43,44,45,46,47],"DEBIAN-CVE-2025-11187","ALPINE-CVE-2025-11187","CGA-2mq2-wcqq-gj8w","CGA-826m-52gp-hm9m","CGA-23g4-p37r-qh6j","CGA-2j7g-wmgr-83ww","CGA-76jv-7c63-79fr","CGA-c4ph-9xv9-9mc2","CGA-p78g-jwmq-2hrg","CGA-rppf-jg3p-3924",[],[50,52,54,56,58,60,62,64,65,67,69,71,72,74,76,78,80,82],{"_key":51},"SUSE-SU-2026:20211-1",{"_key":53},"SUSE-SU-2026:20223-1",{"_key":55},"SUSE-SU-2026:20542-1",{"_key":57},"SUSE-SU-2026:20607-1",{"_key":59},"OPENSUSE-SU-2026:10237-1",{"_key":61},"OPENSUSE-SU-2026:20152-1",{"_key":63},"UBUNTU-CVE-2025-11187",{"_key":38},{"_key":66},"SUSE-SU-2026:2411-1",{"_key":68},"SUSE-SU-2026:22143-1",{"_key":70},"SUSE-SU-2026:2662-1",{"_key":39},{"_key":73},"SUSE-SU-2026:3835-1",{"_key":75},"USN-7980-1",{"_key":77},"RHSA-2026:1472",{"_key":79},"RHSA-2026:1473",{"_key":81},"RHSA-2026:1496",{"_key":83},"RHSA-2026:7261",[],[86,87,88,89,90,91,92,93,94,95,96],{"_key":51},{"_key":53},{"_key":55},{"_key":57},{"_key":59},{"_key":61},{"_key":66},{"_key":68},{"_key":70},{"_key":73},{"_key":97},"CGA-7GC4-88J6-9PGG","2026-01-27T15:59:41.681Z","2026-03-20T14:07:14.610Z","Modified",{"cisa_kev":35,"cisa_ransomware":35,"cisa_vendor":9,"epss_severity":102,"epss_score":103,"severity":104,"severity_score":105,"severity_version":106,"severity_source":107,"severity_vector":108,"severity_status":100},"low",0.04691,"medium",6.1,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",[110,119,125,129,133,138,143,148,152],{"url":111,"sources":112,"tags":116},"https://openssl-library.org/news/secadv/20260127.txt",[107,113,114,115],"nvd","osv_wolfi","osv_chainguard",[117,118],"Vendor Advisory","Advisory",{"url":120,"sources":121,"tags":122},"https://github.com/openssl/openssl/commit/8caf359d6e46fb413e8f5f0df765d2e8a51df4e8",[107,113,114,115],[123,124],"Patch","FIX",{"url":126,"sources":127,"tags":128},"https://github.com/openssl/openssl/commit/e1079bc17ed93ff16f6b86f33a2fe3336e78817e",[107,113,114,115],[123,124],{"url":130,"sources":131,"tags":132},"https://github.com/openssl/openssl/commit/205e3a55e16e4bd08c12fdbd3416ab829c0f6206",[107,113,114,115],[123,124],{"url":32,"sources":134,"tags":135},[107,113,114,115],[136,137],"Exploit","EVIDENCE",{"url":139,"sources":140,"tags":142},"https://security-tracker.debian.org/tracker/CVE-2025-11187",[141],"osv_debian",[118],{"url":144,"sources":145,"tags":147},"https://security.alpinelinux.org/vuln/CVE-2025-11187",[146],"osv_alpine",[118],{"url":149,"sources":150,"tags":151},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11187.json",[114,115],[118],{"url":153,"sources":154,"tags":155},"https://nvd.nist.gov/vuln/detail/CVE-2025-11187",[114,115],[118],[],{"date":158,"score":103,"percentile":159},"2026-09-19",0.9137,[161,165,168,172,175,178,181,185,188,191,194,197,200,203,205,208,211,214,217,220,222,225,228,231,234,237,240,243,246,248,251,254,258,261,264,267,270,273,276,278,281,284,287,290,293,296,299,302,305,308,311,314,317,321,324,327,330,332,335,339,342,345,347,350,353,356,359,362,365,368,371,373,376,379,381,384,387,389,392,395,397,399,401,404,407,410,413,416,419,421],{"date":162,"score":163,"percentile":164},"2026-01-28",0.00019,0.03956,{"date":166,"score":163,"percentile":167},"2026-01-29",0.03972,{"date":169,"score":170,"percentile":171},"2026-01-30",0.00012,0.01373,{"date":173,"score":170,"percentile":174},"2026-01-31",0.01388,{"date":176,"score":170,"percentile":177},"2026-02-01",0.01412,{"date":179,"score":170,"percentile":180},"2026-02-02",0.01496,{"date":182,"score":183,"percentile":184},"2026-02-03",0.00011,0.0114,{"date":186,"score":183,"percentile":187},"2026-02-04",0.01142,{"date":189,"score":183,"percentile":190},"2026-02-05",0.01145,{"date":192,"score":183,"percentile":193},"2026-02-06",0.01162,{"date":195,"score":183,"percentile":196},"2026-02-07",0.01182,{"date":198,"score":183,"percentile":199},"2026-02-08",0.01184,{"date":201,"score":183,"percentile":202},"2026-02-09",0.01181,{"date":204,"score":183,"percentile":202},"2026-02-10",{"date":206,"score":183,"percentile":207},"2026-02-11",0.01254,{"date":209,"score":183,"percentile":210},"2026-02-12",0.0128,{"date":212,"score":183,"percentile":213},"2026-02-13",0.01286,{"date":215,"score":183,"percentile":216},"2026-02-14",0.01311,{"date":218,"score":183,"percentile":219},"2026-02-15",0.01316,{"date":221,"score":183,"percentile":216},"2026-02-16",{"date":223,"score":183,"percentile":224},"2026-02-17",0.01297,{"date":226,"score":183,"percentile":227},"2026-02-18",0.01422,{"date":229,"score":183,"percentile":230},"2026-02-19",0.01418,{"date":232,"score":183,"percentile":233},"2026-02-20",0.01424,{"date":235,"score":183,"percentile":236},"2026-02-21",0.01421,{"date":238,"score":183,"percentile":239},"2026-02-22",0.0142,{"date":241,"score":183,"percentile":242},"2026-02-23",0.01356,{"date":244,"score":183,"percentile":245},"2026-02-24",0.01321,{"date":247,"score":183,"percentile":216},"2026-02-25",{"date":249,"score":183,"percentile":250},"2026-02-26",0.01281,{"date":252,"score":183,"percentile":253},"2026-02-27",0.01313,{"date":255,"score":256,"percentile":257},"2026-02-28",0.00013,0.01899,{"date":259,"score":256,"percentile":260},"2026-03-01",0.01897,{"date":262,"score":256,"percentile":263},"2026-03-02",0.01918,{"date":265,"score":256,"percentile":266},"2026-03-03",0.0193,{"date":268,"score":256,"percentile":269},"2026-03-04",0.01919,{"date":271,"score":256,"percentile":272},"2026-03-05",0.01957,{"date":274,"score":256,"percentile":275},"2026-03-06",0.01954,{"date":277,"score":256,"percentile":275},"2026-03-07",{"date":279,"score":256,"percentile":280},"2026-03-08",0.01946,{"date":282,"score":256,"percentile":283},"2026-03-09",0.01937,{"date":285,"score":256,"percentile":286},"2026-03-10",0.01928,{"date":288,"score":256,"percentile":289},"2026-03-11",0.01898,{"date":291,"score":256,"percentile":292},"2026-03-12",0.0191,{"date":294,"score":256,"percentile":295},"2026-03-13",0.01904,{"date":297,"score":256,"percentile":298},"2026-03-14",0.01876,{"date":300,"score":256,"percentile":301},"2026-03-15",0.01861,{"date":303,"score":256,"percentile":304},"2026-03-16",0.01851,{"date":306,"score":256,"percentile":307},"2026-03-17",0.01829,{"date":309,"score":256,"percentile":310},"2026-03-18",0.01823,{"date":312,"score":256,"percentile":313},"2026-03-19",0.01814,{"date":315,"score":256,"percentile":316},"2026-03-20",0.01817,{"date":318,"score":319,"percentile":320},"2026-03-21",0.00007,0.00503,{"date":322,"score":319,"percentile":323},"2026-03-22",0.00502,{"date":325,"score":319,"percentile":326},"2026-03-23",0.005,{"date":328,"score":319,"percentile":329},"2026-03-24",0.00497,{"date":331,"score":319,"percentile":326},"2026-03-25",{"date":333,"score":319,"percentile":334},"2026-03-26",0.00499,{"date":336,"score":337,"percentile":338},"2026-03-27",0.00006,0.00346,{"date":340,"score":337,"percentile":341},"2026-03-28",0.00351,{"date":343,"score":337,"percentile":344},"2026-03-29",0.00352,{"date":346,"score":337,"percentile":341},"2026-03-30",{"date":348,"score":337,"percentile":349},"2026-03-31",0.00349,{"date":351,"score":337,"percentile":352},"2026-04-01",0.00348,{"date":354,"score":337,"percentile":355},"2026-04-02",0.00354,{"date":357,"score":337,"percentile":358},"2026-04-03",0.00353,{"date":360,"score":337,"percentile":361},"2026-04-04",0.00356,{"date":363,"score":319,"percentile":364},"2026-04-05",0.00489,{"date":366,"score":319,"percentile":367},"2026-04-06",0.00486,{"date":369,"score":319,"percentile":370},"2026-04-07",0.00488,{"date":372,"score":319,"percentile":367},"2026-04-08",{"date":374,"score":319,"percentile":375},"2026-04-09",0.00484,{"date":377,"score":319,"percentile":378},"2026-04-10",0.00485,{"date":380,"score":319,"percentile":375},"2026-04-11",{"date":382,"score":319,"percentile":383},"2026-04-12",0.00481,{"date":385,"score":319,"percentile":386},"2026-04-13",0.00483,{"date":388,"score":319,"percentile":383},"2026-04-14",{"date":390,"score":319,"percentile":391},"2026-04-15",0.00478,{"date":393,"score":319,"percentile":394},"2026-04-16",0.0048,{"date":396,"score":319,"percentile":386},"2026-04-17",{"date":398,"score":319,"percentile":378},"2026-04-18",{"date":400,"score":319,"percentile":383},"2026-04-19",{"date":402,"score":319,"percentile":403},"2026-04-20",0.00477,{"date":405,"score":319,"percentile":406},"2026-04-21",0.00516,{"date":408,"score":319,"percentile":409},"2026-04-22",0.00514,{"date":411,"score":319,"percentile":412},"2026-04-23",0.00513,{"date":414,"score":319,"percentile":415},"2026-04-24",0.00512,{"date":417,"score":319,"percentile":418},"2026-04-25",0.0051,{"date":420,"score":319,"percentile":412},"2026-04-26",{"date":422,"score":319,"percentile":418},"2026-04-27",[424,429,431,433,435,437],{"source":107,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":425,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":426,"vectorString":108,"impactScore":427,"exploitabilityScore":428},"MEDIUM",7.8,3.3,{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":430,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":426,"vectorString":108,"impactScore":427,"exploitabilityScore":428},{"source":141,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":432,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":9,"vectorString":108,"impactScore":427,"exploitabilityScore":428},{"source":146,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":434,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":9,"vectorString":108,"impactScore":427,"exploitabilityScore":428},{"source":114,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":436,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":9,"vectorString":108,"impactScore":427,"exploitabilityScore":428},{"source":115,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":438,"cvss_v4_0":9},{"baseScore":105,"baseSeverity":9,"vectorString":108,"impactScore":427,"exploitabilityScore":428},[440,456,464,467,473,477,482,493],{"ecosystem":441,"name":442,"vendor":443,"product":442,"cpe_part":9,"purl_type":444,"purl_namespace":443,"purl_name":442,"source":9,"versions":445},"Alpine Linux","openssl","alpine","apk",[446,454,455],{"version":447,"is_range":448,"range_type":449,"version_start":450,"version_start_type":451,"version_end":452,"version_end_type":453,"fixed_in":9},"gte3_4_0_lt3_5_5_r0",true,"ecosystem","3.4.0","including","3.5.5-r0","excluding",{"version":447,"is_range":448,"range_type":449,"version_start":450,"version_start_type":451,"version_end":452,"version_end_type":453,"fixed_in":9},{"version":447,"is_range":448,"range_type":449,"version_start":450,"version_start_type":451,"version_end":452,"version_end_type":453,"fixed_in":9},{"ecosystem":457,"name":458,"vendor":459,"product":458,"cpe_part":9,"purl_type":444,"purl_namespace":459,"purl_name":458,"source":9,"versions":460},"Chainguard","libcrypto3-2.34","chainguard",[461],{"version":462,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":463,"version_end_type":453,"fixed_in":9},"lt3_6_1_r0","3.6.1-r0",{"ecosystem":457,"name":442,"vendor":459,"product":442,"cpe_part":9,"purl_type":444,"purl_namespace":459,"purl_name":442,"source":9,"versions":465},[466],{"version":462,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":463,"version_end_type":453,"fixed_in":9},{"ecosystem":457,"name":468,"vendor":459,"product":468,"cpe_part":9,"purl_type":444,"purl_namespace":459,"purl_name":468,"source":9,"versions":469},"openssl-provider-fips-3.4.0",[470],{"version":471,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":472,"version_end_type":453,"fixed_in":9},"lt0","0",{"ecosystem":457,"name":474,"vendor":459,"product":474,"cpe_part":9,"purl_type":444,"purl_namespace":459,"purl_name":474,"source":9,"versions":475},"openssl-provider-fips-3.6.0",[476],{"version":471,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":472,"version_end_type":453,"fixed_in":9},{"ecosystem":478,"name":442,"vendor":479,"product":442,"cpe_part":9,"purl_type":444,"purl_namespace":479,"purl_name":442,"source":9,"versions":480},"Wolfi","wolfi",[481],{"version":462,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":463,"version_end_type":453,"fixed_in":9},{"ecosystem":483,"name":442,"vendor":484,"product":442,"cpe_part":9,"purl_type":485,"purl_namespace":484,"purl_name":442,"source":9,"versions":486},"Debian","debian","deb",[487,490],{"version":488,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":489,"version_end_type":453,"fixed_in":9},"lt3_5_4_1~deb13u2","3.5.4-1~deb13u2",{"version":491,"is_range":448,"range_type":449,"version_start":9,"version_start_type":9,"version_end":492,"version_end_type":453,"fixed_in":9},"lt3_5_5_1","3.5.5-1",{"ecosystem":9,"name":494,"vendor":442,"product":442,"cpe_part":495,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":496},"OpenSSL","a",[497,501,505],{"version":498,"is_range":448,"range_type":499,"version_start":450,"version_start_type":451,"version_end":500,"version_end_type":453,"fixed_in":9},">= 3.4.0, \u003C 3.4.4","cpe","3.4.4",{"version":502,"is_range":448,"range_type":499,"version_start":503,"version_start_type":451,"version_end":504,"version_end_type":453,"fixed_in":9},">= 3.5.0, \u003C 3.5.5","3.5.0","3.5.5",{"version":506,"is_range":448,"range_type":499,"version_start":507,"version_start_type":451,"version_end":508,"version_end_type":453,"fixed_in":9},">= 3.6.0, \u003C 3.6.1","3.6.0","3.6.1"]