{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"grundschutz-oscal-viewer 1.6.36 is published as a bug-hunt hardening release on top of the 1.6.35 security-review line. Per the CHANGELOG [1.6.36], a 6-lens parallel discovery pass plus 3-skeptic adversarial verification examined the codebase and surfaced 9 candidates: 8 were confirmed genuine and fixed — five scored CVSS v3.1 2.9 / v4.0 2.1 (Low): ndaal-sa-2026-163, -165, -167, -168, -169; three scored 0.0 / NONE (informational): ndaal-sa-2026-166, -170, -171 — and 1 was investigated and found to be a false positive against an existing, deliberately fuzzed design decision (ndaal-sa-2026-164, no code change). The release also adds an exhaustive Playwright browser-driven E2E suite (chromium/firefox/webkit) and closes 4 cargo-mutants coverage gaps in src/mappings.rs — neither introduces or fixes a vulnerability."},{"category":"description","text":"This advisory announces the 1.6.36 cut, now published to crates.io and GitLab (tag v1.6.36). The scored findings it collects are Low-severity, availability/correctness-class issues: the encrypted-search annotation lookup running on the async executor thread instead of the blocking pool (163); a quoted multi-line CSV field truncating or dropping mapping rows in a --mappings-dir pack (165); a failed --restore-dump SQL replay leaving a stale destination file that blocked the operator's next retry (167); a rename failure partway through publishing a fetched YARA rule set leaving already-published new files un-rolled-back (168); and a dump failure after the VACUUM INTO snapshot leaving an orphaned .db file that could block a same-stamp retry (169). Three further fixes carry zero security impact: a defense-in-depth mirror of the CSV fix in the embedded frameworks.csv parser with no live external-input path today (166), a stale pre-1.5-era --help default-path string (170), and an ignored RFC 9110 Accept-Language q=0 exclusion that could still serve a client-forbidden language (171). One report (164 — that split_csv_line trims quoted CSV fields) was investigated and confirmed intentional, already-fuzzed behaviour — no code changed. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged."},{"category":"details","text":"Change set: src/routes/search_page.rs (spawn_blocking for encrypted search), src/mappings.rs + src/frameworks.rs (quote-aware CSV record splitting, plus 3 new cargo-mutants regression tests closing gaps in MAX_MAPPING_FILE_BYTES, read_capped's exact-cap boundary, and split_csv_records' unterminated-line handling), src/dbdump.rs (cleanup on restore/dump failure), src/yara_fetch.rs (rename rollback), src/i18n.rs (Accept-Language q=0), src/main.rs (--help fix), test/playwright/ (a new 10-spec-file browser E2E suite across chromium/firefox/webkit, documented in documentation/test_sequences.md §7), CHANGELOG, and CSAF advisories 163-171 plus this announcement. Verification (1.6.36): cargo fmt/clippy -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite), cargo deny check, cargo audit, a parallel three-worktree cargo-mutants sweep (filter.rs 70 mutants/0 missed, sidecar.rs 31/0 missed, mappings.rs 50/4 missed — now closed), and the new Playwright suite (93 passed / 3 skipped across three browsers) all pass. 1.6.36 is live: crates.io reports it as the newest version, the GitLab release v1.6.36 carries all six cross-compiled binaries plus SHA256SUMS, and `cargo binstall` resolves and installs it."},{"category":"general","text":"Recommended action: upgrade via `cargo binstall grundschutz-oscal-viewer` (prebuilt GitLab release binary) or `cargo install grundschutz-oscal-viewer`. No configuration change is required. Operators using an encrypted annotation store benefit from the blocking-pool fix; operators using --mappings-dir CSV packs with multi-line quoted titles get the corrected parser; operators using --restore-dump or --dump-dir get the retry-safety fixes; operators fetching YARA rules get the rollback fix; all operators serving a non-English UI get the corrected Accept-Language handling."},{"category":"other","text":"CVSS applicability: this announcement is scored CVSS v3.1 0.0 (NONE) and v4.0 0.0 (NONE) — it is a release rollup, not itself a newly disclosed vulnerability. The scored findings it collects are tracked individually: ndaal-sa-2026-163/165/167/168/169 (Low, CVSS v3.1 2.9 / v4.0 2.1 each), ndaal-sa-2026-166/170/171 (informational, 0.0/NONE), and ndaal-sa-2026-164 (investigated, confirmed not a defect, 0.0/NONE). Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/223/ndaal-sa-2026-223.json"},{"category":"external","summary":"CHANGELOG (1.6.36 section)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"},{"category":"external","summary":"ndaal-sa-2026-163 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/163/ndaal-sa-2026-163.json"},{"category":"external","summary":"ndaal-sa-2026-164 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/164/ndaal-sa-2026-164.json"},{"category":"external","summary":"ndaal-sa-2026-165 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/165/ndaal-sa-2026-165.json"},{"category":"external","summary":"ndaal-sa-2026-166 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/166/ndaal-sa-2026-166.json"},{"category":"external","summary":"ndaal-sa-2026-167 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/167/ndaal-sa-2026-167.json"},{"category":"external","summary":"ndaal-sa-2026-168 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/168/ndaal-sa-2026-168.json"},{"category":"external","summary":"ndaal-sa-2026-169 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/169/ndaal-sa-2026-169.json"},{"category":"external","summary":"ndaal-sa-2026-170 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/170/ndaal-sa-2026-170.json"},{"category":"external","summary":"ndaal-sa-2026-171 (bug-hunt finding)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/171/ndaal-sa-2026-171.json"},{"category":"external","summary":"grundschutz-oscal-viewer on crates.io","url":"https://crates.io/crates/grundschutz-oscal-viewer"},{"category":"external","summary":"ndaal_public_bsi_grundschutz_oscal_viewer repository","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"},{"category":"external","summary":"GitLab release v1.6.36","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.36"}],"title":"grundschutz-oscal-viewer 1.6.36 — bug-hunt hardening release (5 Low-severity fixes + Playwright E2E suite + cargo-mutants coverage); no new remotely-exploitable weakness","tracking":{"current_release_date":"2026-07-05T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-223","initial_release_date":"2026-07-05T00:00:00.000Z","revision_history":[{"date":"2026-07-05T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory: 1.6.36 release announcement / bug-hunt hardening cut. CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"grundschutz-oscal-viewer","branches":[{"category":"product_version_range","name":"vers:cargo/<1.6.36","product":{"name":"grundschutz-oscal-viewer before 1.6.36.","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.36","product":{"name":"grundschutz-oscal-viewer 1.6.36 — bug-hunt hardening cut.","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"This advisory announces the 1.6.36 cut, now published to crates.io and GitLab (tag v1.6.36). The scored findings it collects are Low-severity, availability/correctness-class issues: the encrypted-search annotation lookup running on the async executor thread instead of the blocking pool (163); a quoted multi-line CSV field truncating or dropping mapping rows in a --mappings-dir pack (165); a failed --restore-dump SQL replay leaving a stale destination file that blocked the operator's next retry (167); a rename failure partway through publishing a fetched YARA rule set leaving already-published new files un-rolled-back (168); and a dump failure after the VACUUM INTO snapshot leaving an orphaned .db file that could block a same-stamp retry (169). Three further fixes carry zero security impact: a defense-in-depth mirror of the CSV fix in the embedded frameworks.csv parser with no live external-input path today (166), a stale pre-1.5-era --help default-path string (170), and an ignored RFC 9110 Accept-Language q=0 exclusion that could still serve a client-forbidden language (171). One report (164 — that split_csv_line trims quoted CSV fields) was investigated and confirmed intentional, already-fuzzed behaviour — no code changed. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged."},{"category":"details","text":"Change set: src/routes/search_page.rs (spawn_blocking for encrypted search), src/mappings.rs + src/frameworks.rs (quote-aware CSV record splitting, plus 3 new cargo-mutants regression tests closing gaps in MAX_MAPPING_FILE_BYTES, read_capped's exact-cap boundary, and split_csv_records' unterminated-line handling), src/dbdump.rs (cleanup on restore/dump failure), src/yara_fetch.rs (rename rollback), src/i18n.rs (Accept-Language q=0), src/main.rs (--help fix), test/playwright/ (a new 10-spec-file browser E2E suite across chromium/firefox/webkit, documented in documentation/test_sequences.md §7), CHANGELOG, and CSAF advisories 163-171 plus this announcement. Verification (1.6.36): cargo fmt/clippy -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite), cargo deny check, cargo audit, a parallel three-worktree cargo-mutants sweep (filter.rs 70 mutants/0 missed, sidecar.rs 31/0 missed, mappings.rs 50/4 missed — now closed), and the new Playwright suite (93 passed / 3 skipped across three browsers) all pass. 1.6.36 is live: crates.io reports it as the newest version, the GitLab release v1.6.36 carries all six cross-compiled binaries plus SHA256SUMS, and `cargo binstall` resolves and installs it."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to grundschutz-oscal-viewer 1.6.36 (CSAFPID-0002).","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0002"]}],"threats":[{"category":"impact","details":"No security impact from the release itself (CVSS 0.0 / NONE); the scored findings it collects are the five Low-severity bug-hunt fixes in ndaal-sa-2026-163/165/167/168/169."}],"title":"grundschutz-oscal-viewer 1.6.36 release — bug-hunt hardening, no new vulnerability"}]}