Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "grundschutz-oscal-viewer 1.6.36 is published as a bug-hunt hardening release on top of the 1.6.35 security-review line. Per the CHANGELOG [1.6.36], a 6-lens parallel discovery pass plus 3-skeptic adversarial verification examined the codebase and surfaced 9 candidates: 8 were confirmed genuine and fixed — five scored CVSS v3.1 2.9 / v4.0 2.1 (Low): ndaal-sa-2026-163, -165, -167, -168, -169; three scored 0.0 / NONE (informational): ndaal-sa-2026-166, -170, -171 — and 1 was investigated and found to be a false positive against an existing, deliberately fuzzed design decision (ndaal-sa-2026-164, no code change). The release also adds an exhaustive Playwright browser-driven E2E suite (chromium/firefox/webkit) and closes 4 cargo-mutants coverage gaps in src/mappings.rs — neither introduces or fixes a vulnerability."
},
{
"category": "description",
"text": "This advisory announces the 1.6.36 cut, now published to crates.io and GitLab (tag v1.6.36). The scored findings it collects are Low-severity, availability/correctness-class issues: the encrypted-search annotation lookup running on the async executor thread instead of the blocking pool (163); a quoted multi-line CSV field truncating or dropping mapping rows in a --mappings-dir pack (165); a failed --restore-dump SQL replay leaving a stale destination file that blocked the operator's next retry (167); a rename failure partway through publishing a fetched YARA rule set leaving already-published new files un-rolled-back (168); and a dump failure after the VACUUM INTO snapshot leaving an orphaned .db file that could block a same-stamp retry (169). Three further fixes carry zero security impact: a defense-in-depth mirror of the CSV fix in the embedded frameworks.csv parser with no live external-input path today (166), a stale pre-1.5-era --help default-path string (170), and an ignored RFC 9110 Accept-Language q=0 exclusion that could still serve a client-forbidden language (171). One report (164 — that split_csv_line trims quoted CSV fields) was investigated and confirmed intentional, already-fuzzed behaviour — no code changed. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged."
},
{
"category": "details",
"text": "Change set: src/routes/search_page.rs (spawn_blocking for encrypted search), src/mappings.rs + src/frameworks.rs (quote-aware CSV record splitting, plus 3 new cargo-mutants regression tests closing gaps in MAX_MAPPING_FILE_BYTES, read_capped's exact-cap boundary, and split_csv_records' unterminated-line handling), src/dbdump.rs (cleanup on restore/dump failure), src/yara_fetch.rs (rename rollback), src/i18n.rs (Accept-Language q=0), src/main.rs (--help fix), test/playwright/ (a new 10-spec-file browser E2E suite across chromium/firefox/webkit, documented in documentation/test_sequences.md §7), CHANGELOG, and CSAF advisories 163-171 plus this announcement. Verification (1.6.36): cargo fmt/clippy -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite), cargo deny check, cargo audit, a parallel three-worktree cargo-mutants sweep (filter.rs 70 mutants/0 missed, sidecar.rs 31/0 missed, mappings.rs 50/4 missed — now closed), and the new Playwright suite (93 passed / 3 skipped across three browsers) all pass. 1.6.36 is live: crates.io reports it as the newest version, the GitLab release v1.6.36 carries all six cross-compiled binaries plus SHA256SUMS, and `cargo binstall` resolves and installs it."
},
{
"category": "general",
"text": "Recommended action: upgrade via `cargo binstall grundschutz-oscal-viewer` (prebuilt GitLab release binary) or `cargo install grundschutz-oscal-viewer`. No configuration change is required. Operators using an encrypted annotation store benefit from the blocking-pool fix; operators using --mappings-dir CSV packs with multi-line quoted titles get the corrected parser; operators using --restore-dump or --dump-dir get the retry-safety fixes; operators fetching YARA rules get the rollback fix; all operators serving a non-English UI get the corrected Accept-Language handling."
},
{
"category": "other",
"text": "CVSS applicability: this announcement is scored CVSS v3.1 0.0 (NONE) and v4.0 0.0 (NONE) — it is a release rollup, not itself a newly disclosed vulnerability. The scored findings it collects are tracked individually: ndaal-sa-2026-163/165/167/168/169 (Low, CVSS v3.1 2.9 / v4.0 2.1 each), ndaal-sa-2026-166/170/171 (informational, 0.0/NONE), and ndaal-sa-2026-164 (investigated, confirmed not a defect, 0.0/NONE). Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/223/ndaal-sa-2026-223.json"
},
{
"category": "external",
"summary": "CHANGELOG (1.6.36 section)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"
},
{
"category": "external",
"summary": "ndaal-sa-2026-163 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/163/ndaal-sa-2026-163.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-164 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/164/ndaal-sa-2026-164.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-165 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/165/ndaal-sa-2026-165.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-166 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/166/ndaal-sa-2026-166.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-167 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/167/ndaal-sa-2026-167.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-168 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/168/ndaal-sa-2026-168.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-169 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/169/ndaal-sa-2026-169.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-170 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/170/ndaal-sa-2026-170.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-171 (bug-hunt finding)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/171/ndaal-sa-2026-171.json"
},
{
"category": "external",
"summary": "grundschutz-oscal-viewer on crates.io",
"url": "https://crates.io/crates/grundschutz-oscal-viewer"
},
{
"category": "external",
"summary": "ndaal_public_bsi_grundschutz_oscal_viewer repository",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"
},
{
"category": "external",
"summary": "GitLab release v1.6.36",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.36"
}
],
"title": "grundschutz-oscal-viewer 1.6.36 — bug-hunt hardening release (5 Low-severity fixes + Playwright E2E suite + cargo-mutants coverage); no new remotely-exploitable weakness",
"tracking": {
"current_release_date": "2026-07-05T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-223",
"initial_release_date": "2026-07-05T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-05T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: 1.6.36 release announcement / bug-hunt hardening cut. CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "grundschutz-oscal-viewer",
"branches": [
{
"category": "product_version_range",
"name": "vers:cargo/<1.6.36",
"product": {
"name": "grundschutz-oscal-viewer before 1.6.36.",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "1.6.36",
"product": {
"name": "grundschutz-oscal-viewer 1.6.36 — bug-hunt hardening cut.",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "This advisory announces the 1.6.36 cut, now published to crates.io and GitLab (tag v1.6.36). The scored findings it collects are Low-severity, availability/correctness-class issues: the encrypted-search annotation lookup running on the async executor thread instead of the blocking pool (163); a quoted multi-line CSV field truncating or dropping mapping rows in a --mappings-dir pack (165); a failed --restore-dump SQL replay leaving a stale destination file that blocked the operator's next retry (167); a rename failure partway through publishing a fetched YARA rule set leaving already-published new files un-rolled-back (168); and a dump failure after the VACUUM INTO snapshot leaving an orphaned .db file that could block a same-stamp retry (169). Three further fixes carry zero security impact: a defense-in-depth mirror of the CSV fix in the embedded frameworks.csv parser with no live external-input path today (166), a stale pre-1.5-era --help default-path string (170), and an ignored RFC 9110 Accept-Language q=0 exclusion that could still serve a client-forbidden language (171). One report (164 — that split_csv_line trims quoted CSV fields) was investigated and confirmed intentional, already-fuzzed behaviour — no code changed. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged."
},
{
"category": "details",
"text": "Change set: src/routes/search_page.rs (spawn_blocking for encrypted search), src/mappings.rs + src/frameworks.rs (quote-aware CSV record splitting, plus 3 new cargo-mutants regression tests closing gaps in MAX_MAPPING_FILE_BYTES, read_capped's exact-cap boundary, and split_csv_records' unterminated-line handling), src/dbdump.rs (cleanup on restore/dump failure), src/yara_fetch.rs (rename rollback), src/i18n.rs (Accept-Language q=0), src/main.rs (--help fix), test/playwright/ (a new 10-spec-file browser E2E suite across chromium/firefox/webkit, documented in documentation/test_sequences.md §7), CHANGELOG, and CSAF advisories 163-171 plus this announcement. Verification (1.6.36): cargo fmt/clippy -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite), cargo deny check, cargo audit, a parallel three-worktree cargo-mutants sweep (filter.rs 70 mutants/0 missed, sidecar.rs 31/0 missed, mappings.rs 50/4 missed — now closed), and the new Playwright suite (93 passed / 3 skipped across three browsers) all pass. 1.6.36 is live: crates.io reports it as the newest version, the GitLab release v1.6.36 carries all six cross-compiled binaries plus SHA256SUMS, and `cargo binstall` resolves and installs it."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to grundschutz-oscal-viewer 1.6.36 (CSAFPID-0002).",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002"
]
}
],
"threats": [
{
"category": "impact",
"details": "No security impact from the release itself (CVSS 0.0 / NONE); the scored findings it collects are the five Low-severity bug-hunt fixes in ndaal-sa-2026-163/165/167/168/169."
}
],
"title": "grundschutz-oscal-viewer 1.6.36 release — bug-hunt hardening, no new vulnerability"
}
]
}