CodeChecker vulnerabilities
CVEs whose affected-version data names the CodeChecker package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-84161Medium· 4.9Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics
When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-control…
CVE-2026-84155Medium· 5.3Session Token Remains Valid After Logout in Multi-Worker Deployments
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the …
CVE-2026-84164None· 0.0Stored XSS in the static HTML report export, because json.dumps does not escape the markup character
The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps doe…
CVE-2026-25660CriticalCodechecker has an authentication bypass for certain API calls
Codechecker has an authentication bypass for certain API calls
CVE-2025-40843Medium· 5.9CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which…
CVE-2025-1300Medium· 6.1CodeChecker open redirect when URL contains multiple slashes after the product name
CodeChecker open redirect when URL contains multiple slashes after the product name
CVE-2021-44217MediumPoCCross-site Scripting in Ericsson CodeChecker
Cross-site Scripting in Ericsson CodeChecker