Edit ndaal-sa-2026-040

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

nvulnlookup v0.1.42 corrects a long-standing CSAF Trusted Provider download bug in `crates/vl-feeders/src/csaf_downloader.rs`.  Releases v0.1.0 through v0.1.41 parsed `changes.csv` and `index.txt` line-by-line with `split_once(',')` and `line.to_owned()` and never stripped RFC 4180 surrounding double-quotes from CSV fields.  CSAF providers that quote every field in their distribution index — Red Hat is the canonical case (`https://security.access.redhat.com/data/csaf/v2/advisories/changes.csv` ships every path as `"YYYY/rhsa-YYYY_NNNN.json"`) — therefore had their advisory paths handed to `join_url` with the literal `"` characters intact.  The URL builder then percent-encoded the quotes as `%22`, producing dead URLs of the form `https://security.access.redhat.com/data/csaf/v2/advisories/%222026/rhsa-2026_13868.json%22`.  Every advisory request from a quoted-CSV provider returned HTTP 404, and the cycle reissued the same dead URLs every six hours.

Net effect on a v0.1.0..v0.1.41 production deployment: zero Red Hat CSAF advisories ever imported (and the same was almost certainly true for any other provider that conforms to RFC 4180 quoting in its index).  The 404 storm also produced runtime starvation: each cycle generated thousands of failed HTTP requests on the same tokio runtime that serves the web UI, so under load the operator-facing endpoints (`/dashboards/*`, `/api/v1/*`) timed out for several minutes per cycle.

v0.1.42 adds a tiny `strip_csv_quotes(s)` helper that strips a leading + trailing `"` pair (RFC 4180 §2.5) and applies it to every CSV field consumed by both parsers, plus three regression-pin tests in `csaf_downloader::tests`.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel