CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2024-7721

CVE-2024-7721: 'MemFray' - The Stack Overflow That Broke the 'Secure' Gateway

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·4 min read·43 visits

Executive Summary (TL;DR)

The 'Fortress' Gateway loves speed so much it forgot how to count. By sending a specially crafted HTTP request with an oversized 'X-Custom-Auth' header, an attacker can overflow a stack buffer, overwrite the return address, and gain a root shell. No authentication required. CVSS 9.8. Patch immediately.

A critical stack-based buffer overflow in the core HTTP packet parser of the widely used 'Fortress' Secure Gateway appliance allows unauthenticated remote attackers to execute arbitrary code with root privileges. The vulnerability stems from an insecure implementation of a custom string copying routine designed for 'performance optimization'.

Official Patches

Fortress NetworksOfficial Security Advisory and Firmware Download

Fix Analysis (1)

Technical Appendix

CVSS Score
9.8/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
92.45%
Top 4% most exploited
45,000
via Shodan

Affected Systems

Fortress Secure Gateway SG-1000Fortress Secure Gateway SG-5000Fortress Virtual Appliance v4.0 - v4.2

Affected Versions Detail

Product
Affected Versions
Fixed Version
Fortress OS
Fortress Networks
>= 4.0.0, < 4.2.14.2.1
AttributeDetail
CWE IDCWE-121 (Stack-based Buffer Overflow)
CVSS v3.19.8 (Critical)
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork (HTTP)
Exploit StatusFunctional PoC Available
EPSS Score0.9245 (High Probability)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1203Exploitation for Client Execution
Execution
CWE-121
Stack-based Buffer Overflow

A stack-based buffer overflow condition exists when a program writes to a memory address on the program's call stack outside of the intended data structure.

Known Exploits & Detection

ExploitDBFortress Gateway unauthenticated RCE python script
GitHubFull ROP chain generator for Fortress OS 4.1
NucleiDetection Template Available

Vulnerability Timeline

Vulnerability discovered by internal red team
2024-04-20
Vendor notified
2024-05-01
Patch released (v4.2.1)
2024-05-10
Added to CISA KEV
2024-05-12
Public PoC released on Twitter
2024-05-13

References & Sources

  • [1]NVD Detail
  • [2]Disassembling Fortress: A Technical Deep Dive
Related Vulnerabilities
CVE-2023-4444CVE-2022-1337

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 4 hours ago•GHSA-F897-62HF-6GXQ
7.5

GHSA-f897-62hf-6gxq: Unbounded Request Body and JSON-RPC Batch DoS in Model Context Protocol TypeScript SDK

The Model Context Protocol (MCP) TypeScript SDK contains an uncontrolled resource consumption vulnerability in its HTTP server transport implementations and middleware adapters. Affected versions fail to enforce upper bounds on incoming HTTP POST request body sizes and JSON-RPC 2.0 batch array lengths. In addition, middleware wrappers for Express and Hono parse request bodies into memory prior to validating Host and Origin headers. Unauthenticated remote attackers can exploit these flaws to trigger Out-Of-Memory (OOM) process crashes or monopolize the single-threaded Node.js event loop.

Amit Schendel
Amit Schendel
2 views•11 min read
•about 5 hours ago•CVE-2026-87029
5.9

CVE-2026-87029: Remote Denial of Service via Uncaught Exception in Node.js Undici Decompress Interceptor

An uncaught exception vulnerability (CWE-248) exists in the Node.js HTTP/1.1 client library undici, affecting versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1. The flaw resides in the DecompressHandler interceptor (lib/interceptor/decompress.js), which processes compressed HTTP response streams using asynchronous Node.js zlib callbacks. When forwarding decompressed data chunks or stream completion events to downstream handlers, the interceptor fails to wrap the invocations of super.onResponseData() and super.onResponseEnd() in try...catch blocks. If a downstream interceptor or handler throws an exception during response processing—such as the built-in dump interceptor enforcing a maximum response size—the exception escapes the asynchronous zlib callback stack onto the top-level Node.js event loop, terminating the entire client process.

Alon Barad
Alon Barad
3 views•10 min read
•about 6 hours ago•CVE-2026-109932
5.9

CVE-2026-109932: Unbounded Memory Consumption via WebSocket PING Frame Flood in Node.js undici

An uncontrolled resource consumption vulnerability in the WebSocket client implementation of Node.js undici allows a remote WebSocket server to trigger an out-of-memory (OOM) crash in the client process. The vulnerability stems from the failure of the incoming frame parser (ByteParser) to respect socket write backpressure when automatically emitting PONG responses to incoming PING control frames. By continuously streaming small 2-byte PING frames while refusing to read from the TCP connection, a malicious server forces the client to queue outbound PONG frames in the V8 heap without bound.

Alon Barad
Alon Barad
2 views•10 min read
•about 7 hours ago•CVE-2026-87018
7.5

CVE-2026-87018: Denial of Service via TLS 1.2 Renegotiation in Node.js Undici

CVE-2026-87018 (GHSA-qrxm-fqhp-jwvm) is a high-severity Denial of Service (DoS) vulnerability in undici, the default HTTP/1.1 and HTTP/2 client for Node.js that backs the global fetch() implementation. The flaw stems from reachable assertions in undici's socket and session error handlers, which assume that TLS hostname verification errors (ERR_TLS_CERT_ALTNAME_INVALID) cannot occur after the initial connection establishment. By initiating a post-handshake TLS 1.2 renegotiation and presenting a certificate with a mismatched Subject Alternative Name (SAN), a remote HTTPS server can trigger this assertion and terminate the entire Node.js runtime process via an uncaught AssertionError.

Amit Schendel
Amit Schendel
4 views•11 min read
•about 8 hours ago•CVE-2026-116682
8.6

CVE-2026-116682: Arbitrary File Read via Improper Symlink Resolution in FileBrowser Quantum

FileBrowser Quantum prior to versions 1.5.2-stable and 2.0.1-beta contains an improper link resolution vulnerability (CWE-59) in its file indexing and retrieval subsystems. When processing file read, download, preview, media streaming, OnlyOffice integration, or public share requests, the application resolves symbolic links via Go's filepath.EvalSymlinks without verifying that the canonical target path remains within the configured source root and the user's assigned access scope. Consequently, authenticated users with read access or unauthenticated holders of public share links can read arbitrary server-accessible files outside their designated directory boundaries.

Amit Schendel
Amit Schendel
5 views•10 min read
•about 9 hours ago•CVE-2026-116676
8.8

CVE-2026-116676: OS Command Injection via Terraform Workspace Parameter in Atlantis

CVE-2026-116676 (GHSA-rjh2-4xgw-p2hj) is an OS command injection vulnerability (CWE-78) in Atlantis, an open-source Go application that automates Terraform pull request workflows via webhooks. From version 0.4.0 prior to version 0.47.1, Atlantis constructed Terraform and Conftest commands by joining argument slices into a single space-separated string and passing them to a shell interpreter (`sh -c`). Because user-controlled workspace names from `atlantis.yaml`, pull request comments, HCL configurations, and API requests were insufficiently validated against shell metacharacters, an authenticated contributor eligible to trigger a Terraform plan can execute arbitrary commands under the Atlantis service account.

Amit Schendel
Amit Schendel
5 views•11 min read