{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"grundschutz-oscal-viewer (the BSI Grundschutz++ OSCAL Viewer) 1.6.46 is a security- and assurance-focused release produced from the 2026-07-14 test-gap analysis. It ships one real behavioural remediation — an anti-DNS-rebinding request-Host allowlist (`--allowed-host` / `GSV_ALLOWED_HOSTS`) — together with a set of test and CI-assurance improvements: testable annotation write-path seams with 16 new branch tests, the previously-inert schemathesis contract gate and the previously-non-blocking cargo-tarpaulin coverage gate both made real and blocking, and a new server-stack DoS-mitigation resilience harness around `serve()` + `ServerLimits`. This announcement is informational and carries no scored finding of its own; the individual changes ship as CSAF advisories ndaal-sa-2026-287 through -291 (288 is the DNS-rebinding remediation, CVSS v3.1 LOW; 287, 289, 290 and 291 are informational / assurance, CVSS 0.0). Versions 1.6.44 and 1.6.45 were interim build cuts folded into this 1.6.46 announcement."},{"category":"description","text":"Per the 1.6.46 release (from the 2026-07-14 test-gap analysis): (1) Anti-DNS-rebinding hardening — the server now enforces a request Host / `:authority` allowlist on same-origin write endpoints, configurable via `--allowed-host` (CLI) and `GSV_ALLOWED_HOSTS` (environment). This is the release's one behavioural security remediation, documented in ndaal-sa-2026-288 (CVSS v3.1 LOW). (2) Assurance and test-coverage work, each shipped as its own CVSS 0.0 advisory: the annotation write-path was refactored into testable sync seams and covered by 16 new branch tests (ndaal-sa-2026-287); the schemathesis contract gate — previously inert (self-skipped on the wrong port) — was made a real, blocking 38-route OpenAPI gate (ndaal-sa-2026-289); the cargo-tarpaulin coverage gate — previously non-blocking — now fails under 80% coverage (ndaal-sa-2026-290); and a server-stack DoS-mitigation resilience harness was added around `serve()` + `ServerLimits`, exercising the connection cap and anti-slowloris timeouts (ndaal-sa-2026-291). Beyond the request-Host allowlist, no viewer runtime behaviour changed."},{"category":"details","text":"This is an informational release announcement (csaf_informational_advisory) and therefore carries no `/vulnerabilities` element; the remediation and the assurance items ship as their own CSAF advisories (287–291), referenced below. The only behavioural change in 1.6.46 is the anti-DNS-rebinding request-Host allowlist (ndaal-sa-2026-288, CVSS v3.1 LOW); the remainder is test-infrastructure and CI-gate hardening that does not alter the shipped viewer's runtime behaviour beyond that allowlist. Versions 1.6.44 and 1.6.45 were interim build cuts folded into this 1.6.46 announcement — no separate product or vulnerability entries are claimed for them."},{"category":"general","text":"Upgrade to grundschutz-oscal-viewer 1.6.46. Operators exposing the viewer beyond loopback should review the new anti-DNS-rebinding request-Host allowlist (`--allowed-host` / `GSV_ALLOWED_HOSTS`) described in ndaal-sa-2026-288 and set it to the hostname(s) the instance is served under."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/292/ndaal-sa-2026-292.json"},{"category":"external","summary":"CHANGELOG (1.6.46 section)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"},{"category":"external","summary":"ndaal-sa-2026-287 (annotation write-path testable sync seams + 16 branch tests; assurance, CVSS 0.0)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/287/ndaal-sa-2026-287.json"},{"category":"external","summary":"ndaal-sa-2026-288 (DNS-rebinding request Host/:authority allowlist on same-origin write endpoints; remediation, CVSS v3.1 LOW)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/288/ndaal-sa-2026-288.json"},{"category":"external","summary":"ndaal-sa-2026-289 (schemathesis contract gate now a real 38-route OpenAPI gate; assurance, CVSS 0.0)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/289/ndaal-sa-2026-289.json"},{"category":"external","summary":"ndaal-sa-2026-290 (cargo-tarpaulin coverage gate now blocking, fails under 80%; assurance, CVSS 0.0)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/290/ndaal-sa-2026-290.json"},{"category":"external","summary":"ndaal-sa-2026-291 (server-stack DoS-mitigation resilience harness: connection-cap + anti-slowloris timeouts; assurance, CVSS 0.0)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/291/ndaal-sa-2026-291.json"},{"category":"external","summary":"grundschutz-oscal-viewer on crates.io","url":"https://crates.io/crates/grundschutz-oscal-viewer/1.6.46"},{"category":"external","summary":"GitLab release v1.6.46","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.46"},{"category":"external","summary":"ndaal_public_bsi_grundschutz_oscal_viewer repository","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"}],"title":"grundschutz-oscal-viewer 1.6.46 — release announcement: anti-DNS-rebinding request-Host allowlist plus a test/assurance hardening pass (testable annotation write-path seams, live schemathesis + cargo-tarpaulin gates, server DoS-mitigation resilience harness); advisories 287–291","tracking":{"current_release_date":"2026-07-15T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-292","initial_release_date":"2026-07-15T00:00:00.000Z","revision_history":[{"date":"2026-07-15T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory: 1.6.46 security + assurance release announcement (anti-DNS-rebinding request-Host allowlist plus test/CI-gate hardening), referencing advisories 287–291. Informational; no vulnerabilities. Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"grundschutz-oscal-viewer","branches":[{"category":"product_version_range","name":"vers:cargo/<1.6.46","product":{"name":"grundschutz-oscal-viewer before 1.6.46.","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.46","product":{"name":"grundschutz-oscal-viewer 1.6.46 — security + assurance release.","product_id":"CSAFPID-0002"}}]}]}]}}