Repository navigation
Security: amule-org/amule
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
amuleapi: state-changing POST routes accept text/plain bodies without an Origin check, so a page on another port of the same host can act as the logged-in adminGHSA-vj9g-4mg6-q9hw published
Oct 28, 2026 by got3nksLow -
EC: tags are not checked against their declared type, so one packet before authentication can leak heap bytes into the log or abort the daemonGHSA-6qxf-6fj4-q8fv published
Oct 28, 2026 by got3nksModerate -
Kad: one KADEMLIA2_SEARCH_KEY_REQ with a large OR expression blocks the main thread for tens of seconds (43.7 s measured)GHSA-52mv-r67q-c985 published
Oct 28, 2026 by got3nksHigh -
Serverlist URLs are fetched without a protocol restriction, so gopher:// sends attacker-chosen bytes to local servicesGHSA-frfq-582f-4jww published
Oct 28, 2026 by got3nksModerate -
EC encryption: synchronous clients (amulecmd, amuleweb, amuleapi) accept cleartext replies on an encrypted sessionGHSA-gc7p-357m-xj2j published
Oct 28, 2026 by got3nksLow -
Multi-part downloads can complete without any MD4 verification when the part hashset never arrivesGHSA-7rxg-6w2f-3w57 published
Oct 28, 2026 by got3nksModerate -
amuleweb: guest session can add downloads and make the core fetch arbitrary URLs through footer.phpGHSA-vh6g-8m3v-wfmf published
Oct 28, 2026 by got3nksModerate -
Peer-supplied OS info is used as a CFormat format string in the statistics tree, crashing amulegui, amulecmd, amuleweb and the GUIGHSA-g22c-pmwf-qmwm published
Oct 28, 2026 by got3nksModerate -
UPnP control point: heap off-by-one write in service URL resolution and use-after-free after ssdp:byebye (LAN attacker)GHSA-cp82-q55r-936c published
Oct 28, 2026 by got3nksHigh -
Pre-authentication crash of amuled via unbounded EC tag nesting (stack exhaustion)GHSA-2crf-cv3v-53w5 published
Oct 28, 2026 by got3nksHigh
Learn more about advisories related to amule-org/amule in the GitHub Advisory Database