Vulnerabilities

TI-2026-19123 CVE-2026-23750 · GHSA-xcg8-xp62-9p7g

Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow

HIGH 67

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling.

CVSS 4.0HIGH 7.2 Adjacent network No auth No interaction EPSS 0.00166 Published 2026-02-26 Fixed CWE-122

TI-2026-19122 CVE-2026-23749 · GHSA-2qjx-h626-j6v4

Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read

MEDIUM 44

Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00184 Published 2026-02-26 Fixed in 0.22.0 CWE-170

TI-2026-19121 CVE-2026-23748 · GHSA-h52p-5g3g-rxjm

Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read

MEDIUM 61

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00308 Published 2026-02-26 Fixed in 0.22.0 CWE-191

TI-2026-19120 CVE-2026-23747 · GHSA-5wx9-6p5v-7r76

Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow

MEDIUM 61

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0034 Published 2026-02-26 Fixed in 0.22.0 CWE-121

Vulnerabilities

Filters

Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow

Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read

Golioth Firmware SDK < 0.22.0 LightDB State Out-of-Bounds Read

Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow