CVE-2026-75625

Katalog CVE

CVSS 9.0 · Critical EPSS 0,24%

Kerentanan Improper Validation of Integrity Check Value. Skor CVSS 3.1 9.0 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

9.0 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/uber/kraken
• https://github.com/uber/kraken/blob/master/lib/torrent/storage/agentstorage/torrent.go
• https://github.com/uber/kraken/issues/638
• https://www.vulncheck.com/advisories/kraken-agents-peer-to-peer-download-cache-poisoning-via-digest-verificati...