Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pocoproject/poco

              main @ 9ce289f
            

Fixes

CVEs

CRITICAL

Peak severity

45.0%

Coverage

Highlights

Memory Corruption: 19 prior fixes. Scrutinize any change in this area.

NetSSL_OpenSSL: most-fixed (7 issues). Treat as high-risk during review.

33 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: The XML parser relies on bundled Expat, which has suffered from multiple critical integer overflows, entity processing bugs, and use-after-free vulnerabilities. Failure to maintain correct entity state and parser lifetimes leads to heap-based corruption.

Improper Certificate Validation: Certificate validation logic was bypassed due to unsafe hostname caches (overwritten by resolved IPs), lack of proper wildcard expression anchoring, and fallback to DNS reverse lookups. This allows active man-in-the-middle attackers to spoof secure peers.

Path Traversal: Deficiencies in ZIP archive path canonicalization permit arbitrary files to be written or overwritten outside the extraction target directory, which is a classic Zip Slip vulnerability (CVE-2017-1000472).