# CWE-392.

Every Advisory and CVE whose sources give the weakness CWE-392, newest first.

## Records, newest first

- [net-imap vulnerable to STARTTLS stripping via invalid response timing](https://agentprime.io/advisories/GHSA-vcgp-9326-pqcp.md)
  `GHSA-vcgp-9326-pqcp`, `CVE-2026-42246` · RubyGems `net-imap`: affected `<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.3.10`, `0.4.24`, `0.5.14`, `0.6.4` · CVSS 7.6 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-325, CWE-392, CWE-393, CWE-636
- [libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure](https://agentprime.io/advisories/GHSA-434v-x5qv-pmh6.md)
  `GHSA-434v-x5qv-pmh6`, `RUSTSEC-2026-0075` · crates.io `libcrux-ed25519`: affected `<0.0.7`, fixed in `0.0.7` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-331, CWE-392, CWE-1240
- [Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resultin…](https://agentprime.io/advisories/CVE-2026-20005.md)
  `CVE-2026-20005` · CVE record: Cisco Cisco Secure Firewall Threat Defense (FTD) Software and 2 more · CVSS 5.8 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-392
- [EVerest libocpp: The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest…](https://agentprime.io/advisories/CVE-2025-59398.md)
  `CVE-2025-59398` · CVE record: EVerest libocpp · CVSS 3.1 Low · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-392
- [NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a side channel vulnerability.](https://agentprime.io/advisories/CVE-2025-23270.md)
  `CVE-2025-23270` · CVE record: NVIDIA Jetson Orin, IGX Orin and Xavier Devices · CVSS 7.1 High · Not analysed yet · Published 17 Jul 2025 · Tags: CWE-392
- [Dragonfly: DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of…](https://agentprime.io/advisories/CVE-2025-26268.md)
  `CVE-2025-26268` · CVE record: DragonflyDB Dragonfly · CVSS 3.3 Low · Not analysed yet · Published 17 Apr 2025 · Tags: CWE-392
- [ConnMan: In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an…](https://agentprime.io/advisories/CVE-2025-32743.md)
  `CVE-2025-32743` · CVE record: ConnMan ConnMan · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-392
- [Vulnerable OpenSSL included in cryptography wheels](https://agentprime.io/advisories/GHSA-79v4-65xg-pq4g.md)
  `GHSA-79v4-65xg-pq4g`, `CVE-2024-12797`, `PYSEC-2026-1284` · PyPI `cryptography`: affected `>=42.0.0, <44.0.1`, fixed in `44.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-392, CWE-1395
- [phonenumber: panic on parsing crafted phonenumber inputs](https://agentprime.io/advisories/GHSA-mjw4-jj88-v687.md)
  `GHSA-mjw4-jj88-v687`, `CVE-2024-39697`, `RUSTSEC-2024-0369` · crates.io `phonenumber`: affected `>=0.3.3, <0.3.6`, fixed in `0.3.6` · CVSS 8.6 High · Not analysed yet · Published 7 Jul 2024 · Tags: Broken access control, Denial of service, CWE-392, CWE-1284
- [A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).](https://agentprime.io/advisories/CVE-2023-48430.md)
  `CVE-2023-48430` · CVE record: Siemens SINEC INS · CVSS 2.7 Low · Not analysed yet · Published 12 Dec 2023 · Tags: CWE-392
- [phonenumber: panic on parsing crafted RF3966 phonenumber inputs](https://agentprime.io/advisories/GHSA-whhr-7f2w-qqj2.md)
  `GHSA-whhr-7f2w-qqj2`, `CVE-2023-42444`, `RUSTSEC-2023-0082` · crates.io `phonenumber`: affected `>=0.0.0-0, <0.2.5 || >=0.3.0, <0.3.3`, fixed in `0.2.5`, `0.3.3` · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-248, CWE-392, CWE-1284
- [blurhash: panic on parsing crafted blurhash inputs](https://agentprime.io/advisories/GHSA-cxvp-82cq-57h2.md)
  `GHSA-cxvp-82cq-57h2`, `CVE-2023-42447`, `RUSTSEC-2023-0083` · crates.io `blurhash`: affected `>=0.0.0-0, <0.2.0`, fixed in `0.2.0` · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-248, CWE-392, CWE-1284
- [SRX Series: MACsec failure to report errors](https://agentprime.io/advisories/CVE-2017-2342.md)
  `CVE-2017-2342` · CVE record: Juniper Networks Junos OS · CVSS 8.1 High · Not analysed yet · Published 14 Jul 2017 · Tags: CWE-392

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-392>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-392/>. Everything for agents: <https://agentprime.io/llms.txt>.