Overview: 1 vulnerability

WSA CVE Score Severity Issue Vulnerability type Scope Versions Fix Release date
WSA-2025-8 - 7.5
Crash on malformed HTTP message in relay plugin, protocol "api". NULL Pointer Dereference Relay 4.7.0 4.7.1

WSA-2025-8: [Relay] Crash on malformed HTTP message in relay plugin, protocol "api".

Vulnerability
CVE
Not available
CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (detail)
CVSS score
7.5 / 10
Severity
high
Vulnerability type
NULL Pointer Dereference (detail)
Scope
Relay
Affected versions
4.7.0
Fixed version
4.7.1 () - ChangeLog
Tracker
Not available
Commits
Description
A crash happens when decoding a malformed HTTP message in relay plugin, protocol "api".
This happens even if the client is not authenticated, the HTTP message is parsed before the authentication.
Mitigation
There are multiple ways to mitigate this issue: