{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"AMBER"},"text":"Verschlusssache: VS-Vertr. (VS-VERTRAULICH) | NATO: NR (NATO RESTRICTED)"},"lang":"en","notes":[{"category":"summary","text":"csaf-crud 1.4.13 is a security and verification cut on top of 1.4.12. It remediates one bundled-dependency finding — h2 queued empty HTTP/2 DATA frames without limit (RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h) — which is reachable here because the product serves HTTP/2 through hyper on its TLS listener. It also fixes a query-decoding defect that turned an invalid percent-escape into a NUL byte, and lands a large body of verification infrastructure: four fuzzing engines driven from one shared body, and four benchmark harnesses. This announcement carries 0.0 / NONE because an announcement is not itself a vulnerability -- not because nothing was fixed.","title":"Summary"},{"category":"other","text":"VS-Vertr. (VS-VERTRAULICH)","title":"Verschlusssache"},{"category":"other","text":"NR (NATO RESTRICTED)","title":"NATO Classification"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"title":"csaf-crud 1.4.13 -- security fix (bundled h2, RUSTSEC-2026-0258) plus a query-decoding fix and four-engine fuzzing","tracking":{"current_release_date":"2026-08-21T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF","version":"1.4.17"}},"id":"ndaal-sa-2026-442","initial_release_date":"2026-08-21T00:00:00.000Z","revision_history":[{"date":"2026-08-21T00:00:00.000Z","number":"1.0.0","summary":"Submitted via web form"}],"status":"draft","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"csaf-crud","product":{"name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG csaf-crud","product_id":"CSAFPID-0001"}}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"This advisory announces the 1.4.13 cut of csaf-crud. The security content is covered by the upstream advisory and is not re-scored here.\r\n\r\nThe operator-visible changes are: h2 advances 0.4.15 -> 0.4.16, closing RUSTSEC-2026-0258; and an invalid percent-escape in a query string no longer decodes to a NUL byte but is left as the literal text it was, so a malformed query can no longer smuggle an interior NUL into a value that is later used as a key or a path component.\r\n\r\nOperators upgrading from 1.4.12 should treat the h2 fix as the reason to move: it affects the network-reachable HTTP/2 listener and has no configuration-level workaround within the product. The remainder of the release is testing infrastructure, which changes no runtime behaviour.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE"}},"products":["CSAFPID-0001"]}],"title":"csaf-crud 1.4.13 release -- security fix, query decoding, four-engine fuzzing"}]}