CVE-2024-45412

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.

• CWE-770

• https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39Patch
• https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxvVendor Advisory
• https://hackerone.com/reports/2258758Exploit, Issue Tracking, Third Party Advisory

Published

Sep 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45407Sunshine is a self-hosted game stream host for Moonlight. Cl…5.3
• CVE-2024-45408eLabFTW is an open source electronic lab notebook for resear…6.5
• CVE-2024-45409The Ruby SAML library is for implementing the client side of…9.8
• CVE-2024-4541The Custom Product List Table plugin for WordPress is vulner…4.3
• CVE-2024-45410Traefik is a golang, Cloud Native Application Proxy. When a …7.5
• CVE-2024-45411Twig is a template language for PHP. Under some circumstance…8.6
• CVE-2024-45413The HTTPD binary in multiple ZTE routers has a stack-based b…8.1
• CVE-2024-45414The HTTPD binary in multiple ZTE routers has a stack-based b…9.8
• CVE-2024-45415The HTTPD binary in multiple ZTE routers has a stack-based b…9.8
• CVE-2024-45416The HTTPD binary in multiple ZTE routers has a local file in…8.1
• CVE-2024-45417Uncontrolled resource consumption in the installer for some …5.5
• CVE-2024-45418Symlink following in the installer for some Zoom apps for ma…8.8