HackerOne Disclosed Reports - 2026-09-03

Medium
resolved

Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server

Bug reported by Byte Override was disclosed at September 3, 2026, 10:13 pm   |   Stack Overflow

A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and required a full server restart. The vulnerability existed since the introduction of ST_GeomFromGeoJSON in MariaDB 10.2.4 and affected all versions through the current development trunk.

Medium
resolved

CVE-2026-19931: Negotiate ambient user conn reuse

Bug reported by Martin Dukek was disclosed at September 3, 2026, 6:09 am   |   Authentication Bypass by Primary Weakness

Low
resolved

CVE-2026-80231: native CA store conn reuse

Bug reported by Anteater was disclosed at September 3, 2026, 6:08 am   |  

Low
resolved

CVE-2026-13608: OpenLDAP SASL authentication bypass

Bug reported by Eunsoo Kim was disclosed at September 3, 2026, 12:35 am   |   Authentication Bypass by Primary Weakness

A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL support was introduced and was unchanged in the current release.