Skip to content

CVE-2024-10964: bound cmd.library copy on v2.8 - #2740

Open
vulgraph wants to merge 1 commit into
emqx:v2.8from
vulgraph:backport/CVE-2024-10964-v2.8
Open

vulgraph wants to merge 1 commit into
emqx:v2.8from
vulgraph:backport/CVE-2024-10964-v2.8

Conversation

@vulgraph

Copy link
Copy Markdown

Same handle_add_plugin/handle_update_plugin strncpy-bound fix as landed for v2.9 / v2.7 / v2.6, targeting the v2.8 line. The otel_trace_type field from the original upstream diff isn't present on v2.8's neu_reqresp_head_t so it's dropped; just the library-copy bound is applied (NEU_PLUGIN_LIBRARY_LEN is already defined at include/neuron/define.h).

(cherry picked from commit 3e3a583)
@vulgraph

vulgraph commented May 2, 2026

Copy link
Copy Markdown
Author

@hxy7yx thanks for the approval. Standing by for merge whenever it fits the release cadence.

@vulgraph

vulgraph commented May 3, 2026

Copy link
Copy Markdown
Author

Thanks @hxy7yx, and for the reviews on the sister PRs as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants