ndaal Informational Advisory: /kev and /recent pagination never advanced — numeric query parameters were dropped by parse_query

Metadata

Vulnerabilities (0)

No vulnerabilities.

Raw JSON

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The web query-string parser (`parse_query`) handed every value to serde as a JSON string, but the `page`/`days` fields of KevQuery and RecentQuery are numeric. serde_json will not coerce a string into a number, so the WHOLE query struct failed to deserialise whenever a numeric field was present, and the handler silently fell back to defaults — every page of /kev and /recent rendered page 1. Functional defect only; the data remained available via the API and other views, so no CVSS is assigned (no confidentiality, integrity, or availability impact on the data itself). Fixed in 0.1.51.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Fix: a string-tolerant `de_opt_from_str` deserializer is applied to the numeric query fields, so `?page=N` / `?days=N` parse correctly and a non-numeric value degrades to None instead of dropping the whole query. The /kev navigator was additionally rebuilt as the dashboard-style numbered 'Page X of N' component. Regression tests cover numeric-page, missing-page, and junk-page parsing.",
        "title": "Description"
      },
      {
        "category": "general",
        "text": "Upgrade to nvulnlookup 0.1.51. No configuration change is required.",
        "title": "Recommended action"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/091/ndaal-sa-2026-091.json"
      },
      {
        "category": "external",
        "summary": "ndaal_public_nvulnlookup repository",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup"
      },
      {
        "category": "external",
        "summary": "nvulnlookup CHANGELOG",
        "url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/CHANGELOG.md"
      }
    ],
    "title": "ndaal Informational Advisory: /kev and /recent pagination never advanced — numeric query parameters were dropped by parse_query",
    "tracking": {
      "current_release_date": "2026-06-04T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-091",
      "initial_release_date": "2026-06-04T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-04T00:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial advisory."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
        "branches": [
          {
            "category": "product_name",
            "name": "nvulnlookup",
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:cargo/>=0.1.0|<0.1.51",
                "product": {
                  "name": "nvulnlookup prior to 0.1.51 (affected)",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "0.1.51",
                "product": {
                  "name": "nvulnlookup 0.1.51 (fixed)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          }
        ]
      }
    ]
  }
}