CVE-2020-36406

uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's position is that this is "a minor issue or not even an issue at all" because the developer of an application (that uses uWebSockets) should not be allowing the large number of triggered topics to accumulate

• CWE-787

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yamlThird Party Advisory
• https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759Patch, Third Party Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/uwebsockets/OSV-2020-1695.yamlThird Party Advisory
• https://github.com/uNetworking/uWebSockets/commit/03fca626a95130ab80f86adada54b29d27242759Patch, Third Party Advisory

Published

Jul 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36400ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq:…9.8
• CVE-2020-36401mruby 2.1.2 has a double free in mrb_default_allocf (called …7.8
• CVE-2020-36402Solidity 0.7.5 has a stack-use-after-return issue in smtutil…7.8
• CVE-2020-36403HTSlib through 1.10.2 allows out-of-bounds write access in v…8.8
• CVE-2020-36404Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallV…7.8
• CVE-2020-36405Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Op…7.8
• CVE-2020-36407libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDe…8.8
• CVE-2020-36408A stored cross scripting (XSS) vulnerability in CMS Made Sim…5.4
• CVE-2020-36409A stored cross scripting (XSS) vulnerability in CMS Made Sim…5.4
• CVE-2020-3641Integer overflow may occur if atom size is less than atom of…9.8
• CVE-2020-36410A stored cross scripting (XSS) vulnerability in CMS Made Sim…5.4
• CVE-2020-36411A stored cross scripting (XSS) vulnerability in CMS Made Sim…5.4