CVE-2024-56375

An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.

• CWE-191
• CWE-191

• https://github.com/NICMx/FORT-validator/issues/154Issue Tracking, Vendor Advisory
• https://nicmx.github.io/FORT-validator/CVE.htmlVendor Advisory

Published

Dec 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56369In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-5637The Market Exporter plugin for WordPress is vulnerable to un…8.1
• CVE-2024-56370Net::Xero 0.044 and earlier for Perl uses the rand() functio…6.5
• CVE-2024-56372In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-56373DAG Author (who already has quite a lot of permissions) coul…8.4
• CVE-2024-56374An issue was discovered in Django 5.1 before 5.1.5, 5.0 befo…7.5
• CVE-2024-56376A stored cross-site scripting (XSS) vulnerability in the bui…5.4
• CVE-2024-56377A stored cross-site scripting (XSS) vulnerability in survey …5.4
• CVE-2024-56378libpoppler.so in Poppler through 24.12.0 has an out-of-bound…4.3
• CVE-2024-5638The Formula theme for WordPress is vulnerable to Reflected C…6.1
• CVE-2024-5639The User Profile Picture plugin for WordPress is vulnerable …4.3
• CVE-2024-5640The Prime Slider – Addons For Elementor (Revolution of a sli…5.4