Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hashicorp/memberlist

              master @ 44cfdfb
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Cryptographic Weakness: 1 prior fix. Scrutinize any change in this area.

security.go: most-fixed (5 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Encryption Bypass: Decryption only attempted with the primary key, rejecting messages encrypted with other configured keys, which could lead to denial of service or misrouting in multi-key deployments.

Cryptographic Weakness: Use of AES-CBC-HMAC encryption is cryptographically weak due to known vulnerabilities (e.g., padding oracle, malleability), addressed by migrating to AES-GCM.

Weak Cryptography: Reusing the same key for encryption and HMAC enables key-reuse attacks; separate derived keys are required.