CVE-2015-2313

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.

• CWE-400

• http://www.openwall.com/lists/oss-security/2015/03/17/3Mailing List, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780568Mailing List, Third Party Advisory
• https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-05-0-c%2B%2B-addl-cpu-amplification.mdThird Party Advisory
• https://github.com/capnproto/capnproto/commit/80149744bdafa3ad4eedc83f8ab675e27baee868Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/03/17/3Mailing List, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780568Mailing List, Third Party Advisory
• https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-05-0-c%2B%2B-addl-cpu-amplification.mdThird Party Advisory
• https://github.com/capnproto/capnproto/commit/80149744bdafa3ad4eedc83f8ab675e27baee868Third Party Advisory

Published

Aug 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2304Absolute path traversal vulnerability in bsdcpio in libarchi…
• CVE-2015-2305Integer overflow in the regcomp implementation in the Henry …
• CVE-2015-2308Eval injection vulnerability in the HttpCache class in HttpK…
• CVE-2015-2310Integer overflow in layout.c++ in Sandstorm Cap'n Proto befo…9.1
• CVE-2015-2311Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 an…
• CVE-2015-2312Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.…
• CVE-2015-2314SQL injection vulnerability in the WPML plugin before 3.1.9 …
• CVE-2015-2315Cross-site scripting (XSS) vulnerability in the WPML plugin …
• CVE-2015-2316The utils.html.strip_tags function in Django 1.6.x before 1.…
• CVE-2015-2317The utils.http.is_safe_url function in Django before 1.4.20,…
• CVE-2015-2318The TLS stack in Mono before 3.12.1 allows man-in-the-middle…
• CVE-2015-2319The TLS stack in Mono before 3.12.1 makes it easier for remo…