{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"The web query-string parser (`parse_query`) handed every value to serde as a JSON string, but the `page`/`days` fields of KevQuery and RecentQuery are numeric. serde_json will not coerce a string into a number, so the WHOLE query struct failed to deserialise whenever a numeric field was present, and the handler silently fell back to defaults — every page of /kev and /recent rendered page 1. Functional defect only; the data remained available via the API and other views, so no CVSS is assigned (no confidentiality, integrity, or availability impact on the data itself). Fixed in 0.1.51.","title":"Summary"},{"category":"description","text":"Fix: a string-tolerant `de_opt_from_str` deserializer is applied to the numeric query fields, so `?page=N` / `?days=N` parse correctly and a non-numeric value degrades to None instead of dropping the whole query. The /kev navigator was additionally rebuilt as the dashboard-style numbered 'Page X of N' component. Regression tests cover numeric-page, missing-page, and junk-page parsing.","title":"Description"},{"category":"general","text":"Upgrade to nvulnlookup 0.1.51. No configuration change is required.","title":"Recommended action"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/091/ndaal-sa-2026-091.json"},{"category":"external","summary":"ndaal_public_nvulnlookup repository","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup"},{"category":"external","summary":"nvulnlookup CHANGELOG","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/CHANGELOG.md"}],"title":"ndaal Informational Advisory: /kev and /recent pagination never advanced — numeric query parameters were dropped by parse_query","tracking":{"current_release_date":"2026-06-04T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-091","initial_release_date":"2026-06-04T00:00:00.000Z","revision_history":[{"date":"2026-06-04T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"nvulnlookup","branches":[{"category":"product_version_range","name":"vers:cargo/>=0.1.0|<0.1.51","product":{"name":"nvulnlookup prior to 0.1.51 (affected)","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"0.1.51","product":{"name":"nvulnlookup 0.1.51 (fixed)","product_id":"CSAFPID-0002"}}]}]}]}}