CVE-2025-15284
published 2025-12-29CVE-2025-15284: Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.41%
33.6th percentile
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).
Vulnerable code (lib/parse.js:159-162):
if (root === '[]' && options.parseArrays) {
obj = utils.combine([], leaf); // No arrayLimit check
}
Working code (lib/parse.js:175):
else if (index <= options.arrayLimit) { // Limit checked here
obj = [];
obj[index] = leaf;
}
The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.
PoC
const qs = require('qs');
const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length); // Output: 6 (should be max 5)
Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.
Impact
Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-qs | < node-qs 6.14.1+ds+~6.14.0-1 (forky) | node-qs 6.14.1+ds+~6.14.0-1 (forky) |
| debian | node-qs | < node-qs 6.15.0+ds+~6.15.0-1 (forky) | node-qs 6.15.0+ds+~6.15.0-1 (forky) |
| msrc | azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_reaper_3.1.1-22_on_cbl_mariner_2.0 | — | — |
| qs_project | qs | < 6.14.1 | 6.14.1 |
| qs_project | qs | >= 0 < 6.14.1 | 6.14.1 |
| qs_project | qs | >= 6.7.0 < 6.14.2 | 6.14.2 |
| qs_project | qs | >= 6.7.0 < 6.14.2 | 6.14.2 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.3MEDIUM
osv6.3MEDIUM
vendor_msrc7.5HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
qs's arrayLimit bypass in comma parsing allows denial of service
osv·2026-02-12·CVSS 6.3
CVE-2026-2391 [MEDIUM] qs's arrayLimit bypass in comma parsing allows denial of service
qs's arrayLimit bypass in comma parsing allows denial of service
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
### Details
When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation
GHSA
qs's arrayLimit bypass in comma parsing allows denial of service
ghsa·2026-02-12·CVSS 6.3
CVE-2026-2391 [MEDIUM] CWE-20 qs's arrayLimit bypass in comma parsing allows denial of service
qs's arrayLimit bypass in comma parsing allows denial of service
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
### Details
When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation
OSV
CVE-2026-2391: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to caus
osv·2026-02-12·CVSS 6.3
CVE-2026-2391 [MEDIUM] CVE-2026-2391: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to caus
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284). ### Details When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to ex
GHSA
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
ghsa·2025-12-30
CVE-2025-15284 [MEDIUM] CWE-20 qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
### Summary
The `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1&a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.
**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.
### Details
The `arrayLimit` option only checked limits for indexed notation (`a[0]=1&a[1]=2`) but did not enforce it for bracket notation (`a[]=1&a[]=2`).
**V
OSV
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
osv·2025-12-30
CVE-2025-15284 [MEDIUM] qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
### Summary
The `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1&a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.
**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.
### Details
The `arrayLimit` option only checked limits for indexed notation (`a[0]=1&a[1]=2`) but did not enforce it for bracket notation (`a[]=1&a[]=2`).
**V
OSV
CVE-2025-15284: Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS
osv·2025-12-29·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284: Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable co
CISA ICS
Siemens SIDIS Prime
cisa_ics·2026-03-12·CVSS 7.5
[HIGH] Siemens SIDIS Prime
ICS Advisory
##
Siemens SIDIS Prime
Release DateMarch 12, 2026
Alert CodeICSA-26-071-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
The following versions of Siemens SIDIS Prime are affected:
- SIDIS Prime vers:intdot/<4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-202
Red Hat
qs: qs's arrayLimit bypass in comma parsing allows denial of service
vendor_redhat·2026-02-12·CVSS 6.3
CVE-2026-2391 [MEDIUM] CWE-179 qs: qs's arrayLimit bypass in comma parsing allows denial of service
qs: qs's arrayLimit bypass in comma parsing allows denial of service
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
### Details
When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creat
Debian
CVE-2026-2391: node-qs - ### Summary The `arrayLimit` option in qs does not enforce limits for comma-sepa...
vendor_debian·2026·CVSS 6.3
CVE-2026-2391 [MEDIUM] CVE-2026-2391: node-qs - ### Summary The `arrayLimit` option in qs does not enforce limits for comma-sepa...
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284). ### Details When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to ex
Red Hat
qs: qs: Denial of Service via improper input validation in array parsing
vendor_redhat·2025-12-29·CVSS 6.3
CVE-2025-15284 [MEDIUM] CWE-770 qs: qs: Denial of Service via improper input validation in array parsing
qs: qs: Denial of Service via improper input validation in array parsing
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2
Microsoft
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
vendor_msrc·2025-12-09·CVSS 7.5
CVE-2025-15284 [MEDIUM] CWE-20 arrayLimit bypass in bracket notation allows DoS via memory exhaustion
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Mariner: Mariner
harborist: harborist
Customer Action Required: Yes
Debian
CVE-2025-15284: node-qs - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.Th...
vendor_debian·2025·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284: node-qs - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.Th...
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable co
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-2391 qs: qs's arrayLimit bypass in comma parsing allows denial of service
bugzilla·2026-02-12·CVSS 6.3
CVE-2026-2391 [MEDIUM] CVE-2026-2391 qs: qs's arrayLimit bypass in comma parsing allows denial of service
CVE-2026-2391 qs: qs's arrayLimit bypass in comma parsing allows denial of service
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
### Details
When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. Thi
Bugzilla
CVE-2025-15284 firefox: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 firefox: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 firefox: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-15284 mozjs115: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 mozjs115: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 mozjs115: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-15284 magicmirror-module-onthisday: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 magicmirror-module-onthisday: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 magicmirror-module-onthisday: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
I
Bugzilla
CVE-2025-15284 h3: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 h3: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 h3: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to cl
Bugzilla
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [epel-10]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [epel-10]
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This comes from the qs JavaScript library. I'm not really sure how this impacts PyTorch, but it must be present in one of our build inputs or outputs?
---
I'm closing with the v
Bugzilla
CVE-2025-15284 icecat: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 icecat: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 icecat: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy t
Bugzilla
CVE-2025-15284 yarnpkg: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 yarnpkg: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 yarnpkg: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-15284 magicmirror: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 magicmirror: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 magicmirror: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's pol
Bugzilla
CVE-2025-15284 thunderbird: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 thunderbird: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 thunderbird: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's pol
Bugzilla
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-43]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-43]
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This comes from the qs JavaScript library. I'm not really sure how this impacts PyTorch, but it must be present in one of our build inputs or outputs?
---
I'm closing with the
Bugzilla
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-42]
bugzilla·2025-12-31·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-42]
CVE-2025-15284 python-torch: qs: Denial of Service via improper input validation in array parsing [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This comes from the qs JavaScript library. I'm not really sure how this impacts PyTorch, but it must be present in one of our build inputs or outputs?
---
I'm closing with the
Bugzilla
CVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsing
bugzilla·2025-12-29·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsing
CVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsing
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
SummaryThe arrayLimit option in qs does not enforce limits for bracket notation (a[]=1&a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit for DoS protection are vulnerable.
DetailsThe arrayLimit option only checks limits for indexed notation (a[0]=1&a[1]=2) but completely bypasses it for bracket notation (a[]=1&a[]=2).
Vulnerable code (lib/parse.js:159-162):
if (root === '[]' && options.parseArrays) {
obj = utils.combine([], leaf); // No arrayLimit check
}
Working code (lib/parse.js:175):
else if (index <= options.arrayLimit) { //
Wiz
CVE-2025-15284 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-15284 [MEDIUM] CVE-2025-15284 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-15284 :
JavaScript vulnerability analysis and mitigation
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]
2025-12-29
Published