{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "AMBER"
},
"text": "Verschlusssache: VS-Vertr. (VS-VERTRAULICH) | NATO: NR (NATO RESTRICTED)"
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "csaf-crud 1.4.13 is a security and verification cut on top of 1.4.12. It remediates one bundled-dependency finding — h2 queued empty HTTP/2 DATA frames without limit (RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h) — which is reachable here because the product serves HTTP/2 through hyper on its TLS listener. It also fixes a query-decoding defect that turned an invalid percent-escape into a NUL byte, and lands a large body of verification infrastructure: four fuzzing engines driven from one shared body, and four benchmark harnesses. This announcement carries 0.0 / NONE because an announcement is not itself a vulnerability -- not because nothing was fixed.",
"title": "Summary"
},
{
"category": "other",
"text": "VS-Vertr. (VS-VERTRAULICH)",
"title": "Verschlusssache"
},
{
"category": "other",
"text": "NR (NATO RESTRICTED)",
"title": "NATO Classification"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"title": "csaf-crud 1.4.13 -- security fix (bundled h2, RUSTSEC-2026-0258) plus a query-decoding fix and four-engine fuzzing",
"tracking": {
"current_release_date": "2026-08-21T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF",
"version": "1.4.17"
}
},
"id": "ndaal-sa-2026-442",
"initial_release_date": "2026-08-21T00:00:00.000Z",
"revision_history": [
{
"date": "2026-08-21T00:00:00.000Z",
"number": "1.0.0",
"summary": "Submitted via web form"
}
],
"status": "draft",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "csaf-crud",
"product": {
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG csaf-crud",
"product_id": "CSAFPID-0001"
}
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "This advisory announces the 1.4.13 cut of csaf-crud. The security content is covered by the upstream advisory and is not re-scored here.\r\n\r\nThe operator-visible changes are: h2 advances 0.4.15 -> 0.4.16, closing RUSTSEC-2026-0258; and an invalid percent-escape in a query string no longer decodes to a NUL byte but is left as the literal text it was, so a malformed query can no longer smuggle an interior NUL into a value that is later used as a key or a path component.\r\n\r\nOperators upgrading from 1.4.12 should treat the h2 fix as the reason to move: it affects the network-reachable HTTP/2 listener and has no configuration-level workaround within the product. The remainder of the release is testing infrastructure, which changes no runtime behaviour.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "csaf-crud 1.4.13 release -- security fix, query decoding, four-engine fuzzing"
}
]
}