Argo · real-world validation

Bugs found by reading the code, disclosed in the open.

Every vulnerability below was surfaced by Argo, an LLM-native static auditor, then hand-verified and reported upstream: as a public pull request or a published security advisory. Follow any link to the fix or advisory itself.

Projects

Public PRs

Already resolved

Languages (of many)

CVEs assigned

Scope Only findings that are already publicly disclosed are listed, each linking to its upstream pull request or published security advisory. Findings still under coordinated (private) disclosure are omitted until they go public. Argo itself is language-agnostic and has audited well beyond the languages shown here.

Recognition Credited on LiveKit's Security Hall of Fame. The disclosure itself was private, but the findings below that are now confirmed fixed each link to a real, public upstream pull request. The PRs don't individually name the reporter; the Hall of Fame page is where that credit lives. The remaining reported findings stay off this list until they're fixed too.

Disclosures

merged fixes first · then open review

open62541C

Open-source C implementation of the OPC UA industrial communication stack.

6 merged

PR #8440 Out-of-bounds read/write and silent truncation in the PKCS#11 TPM AES-CTR PubSub en/decrypt — a block-aligned size stored in an 8-bit CK_BYTE wraps past 255 (fix into 1.3–1.4) HighOOB read/write1.3–1.4 Merged

PR #8441 Same PKCS#11 TPM AES-CTR out-of-bounds read/write and truncation fix, forward-ported to the 1.5 branch HighOOB read/write1.5 Merged

PR #8442 A malformed async MSG response made the client clear an uninitialized UA_Response on the decode-failure path (uninitialized read) Highuninitialized read Merged

PR #8444 HMAC/MAC verification compared tags with a non-constant-time, early-exit memcmp (a remotely observable timing side channel); switched to a length-checked constant-time compare Mediumtiming side channel Merged

PR #8447 Malicious OpenSecureChannel responses leaked decoded client-side heap on the nonce-reuse/error path — now freed (fix into 1.3) Mediummemory leak1.3 Merged

PR #8448 Same OpenSecureChannel decoded-heap leak fix, forward-ported to the 1.4 branch Mediummemory leak1.4 Merged

PocketBaseGo

Open-source Go backend: SQLite database, auth and admin dashboard in one file.

1 advisory

GHSA Unhandled panics in internal worker goroutines could terminate the server (fixed in v0.39.7 / v0.22.48, reporter credited) High8.7worker-goroutine panic (DoS)CVE-2026-82410 Advisory · fixed

NavidromeGo

Self-hosted music streaming server, Subsonic-API compatible.

3 advisories

GHSA Share creation trusted a client-supplied userId as the share owner, exposing another user's library content (fixed in v0.64.0, reporter credited) HighIDOR / broken access control Advisory · fixed

GHSA SQL injection via the artist role parameter, interpolated into a raw SQL ORDER BY when sorting by song/album count or size (fixed in v0.64.0, reporter credited) HighSQL injection Advisory · fixed

GHSA Plugin HTTP/WebSocket SSRF guard bypassable via DNS names resolving to private/loopback addresses (fixed in v0.64.0, co-credited) MediumSSRF Advisory · fixed

MediaMTXGo

Zero-dependency real-time media server & proxy (RTSP, RTMP, HLS, WebRTC, SRT, MoQ).

1 advisory

GHSA Pre-auth whole-process crash (DoS): unbounded memory allocation from MoQ varint length fields — the SUBSCRIBE/PUBLISH namespace count and subgroup properties length each drive an unchecked make(), reachable before authentication on the default MoQ listener (fixed in v1.19.3, reporter credited) HighMoQ varint unbounded alloc (pre-auth DoS) Advisory · fixed

legbaRust

A fast, modern credential brute-forcer and password sprayer.

5 merged

PR #98 Two remote-triggerable panics (DoS) from untrusted input Highremote DoS Merged

PR #99 Bound two server-controlled allocations (Kerberos, AMQP) + Kerberos read timeout Highunbounded alloc Merged

PR #100 Cap the IRC banner read + add a read deadline Highremote DoS Merged

PR #101 Avoid a panic on a multi-byte UTF-8 SMTP reply line Highpanic / DoS Merged

PR #102 Add read/write timeouts to the RDP connection Highremote hang Merged

halloyRust

A modern IRC client.

3 merged2 open

PR #2149 Harden against three remote-DoS issues (reported via private advisory) Highremote DoS ×3 Merged

PR #2331 Bound the number of concurrently open IRCv3 batches from a server Mediumunbounded batches (DoS) Merged

PR #2329 Harden DCC filename sanitization against reserved names and illegal characters MediumDCC filename sanitization Open

PR #2330 Guard server-icon decoding against oversized (decompression-bomb) images Mediumdecompression bomb Merged

PR #2332 Redact credentials from the IRC protocol log Mediumcredential logging Open

libcspC

The CubeSat Space Protocol: a small network stack used on spacecraft and embedded systems.

1 merged

PR #992 Fix use-after-free in the CSP_PS service handler Highuse-after-free Merged

moquetteJava

A lightweight MQTT broker.

6 merged

GHSA Pattern-ACL wildcard injection lets an attacker widen per-tenant %c/%u ACL rules via clientId/username Criticalauthz bypassCVE-2026-85724 Advisory · fixed

PR #959 Guard the periodic expiration task so one failing entity can't disable all expirations Mediumfail-open / DoS Merged

PR #958 Reject a malformed $share subscription before parsing it Highremote DoS Merged

PR #957 Keep the session event loop alive when a command throws Highremote DoS Merged

PR #964 Namespace the H2 queue metadata map to prevent a client-id collision Mediumdurable corruption Merged

PR #963 Guard pattern ACL substitution against a null username Highremote DoS Merged

PR #967 Fail closed (not open to PermitAll/AcceptAll) when a configured authorizator/authenticator class fails to load Mediumfail-open authz Merged

ds4C

A compact C engine for running DeepSeek-class LLMs with an agent / tool loop.

10 resolved

PR #539 Fix pre-auth double-free in the JSON request parser (applied via commit 8e49a5c, co-authored with antirez) Criticaldouble-free Merged upstream merged ↗

PR #542 Bound file-declared length prefixes in the model loader (applied via commit c7689db, co-authored with antirez, alongside #543 and #545) Highheap overflow Merged upstream merged ↗

PR #543 Cross-check tensor data size against shape in FP8/FP4 dequant (applied via commit c7689db, co-authored with antirez, alongside #542 and #545) Mediumout-of-bounds read Merged upstream merged ↗

PR #544 Cap file-declared lengths in agent KV-cache reads (applied via commit 0fa15c6, co-authored with antirez) Mediummemory DoS Merged upstream merged ↗

PR #545 Bound GGUF metadata / tensor counts by file size before allocating (applied via commit c7689db, co-authored with antirez, alongside #542 and #543) Mediumresource exhaustion Merged upstream merged ↗

PR #546 Reject an oversized snapshot token_count before allocating (applied via commit f02d79c, co-authored with antirez) Lowdistributed DoS Merged upstream merged ↗

PR #547 Make tool-output validation O(n) instead of O(n²) (pre-auth CPU DoS) (applied via commit a169cff, co-authored with antirez) Mediumalgorithmic DoS Merged upstream merged ↗

PR #548 Bound tokenizer merges count to INT32_MAX like the tokens table (antirez/ds4#548 itself is still open upstream; adopted with authorship preserved into the community fork elkaix/ds4) Lowinteger bound Merged in fork ↗

PR #541 Handle NaN in json_int() (undefined double→int cast) (applied via commit 8340f35, co-authored with antirez) Lowundefined behavior Merged upstream merged ↗

PR #? Unlink the bash-tool output temp file on job cleanup (antirez/ds4#540 itself is still open upstream; adopted with authorship preserved into the community fork elkaix/ds4) Lowresource cleanup Merged in fork ↗

Issue #549 Follow-up hardening / design items from a security review hardening notes Issue

gguf-toolsC

A C implementation of the GGUF model-file format used by llama.cpp / ggml.

3 open PRs

PR #31 Fix an out-of-bounds write in the Q4_0/Q4_1 dequantizer's second block loop Highheap overflow Open · in review

PR #32 Grow the split-mixtral tensor array instead of asserting (heap overflow on crafted models) Highheap overflow Open · in review

PR #33 Bound tensor data offset/size against the mapping in gguf_get_tensor Mediumout-of-bounds read Open · in review

RecuperaBitPython

Reconstructs and recovers files from damaged NTFS file systems.

2 merged

PR #143 Isolate command dispatch and the deep-parse phase from crashing the whole session Highcrash isolation Merged

PR #144 Escape reconstructed names in CSV, body-file and Tikz/LaTeX exports Mediumoutput injection Merged

authentikPython

A self-hosted identity provider (SSO) implementing SAML, OAuth2/OIDC, LDAP and SCIM.

2 advisories

GHSA A SAML Source accepted an assertion an IdP had issued for a different service provider, and accepted the same assertion more than once, allowing an authentication bypass (fixed in 2026.2.7 / 2026.5.7 / 2026.8.2, reporter credited) High7.4auth bypassSAML assertion confusion / replay Advisory · fixed

GHSA Several credential-bearing configurations returned their stored secrets over the API to anyone holding view permission alone (fixed in 2026.2.7 / 2026.5.7 / 2026.8.2, reporter credited) High8.1credential exposurebroken access control Advisory · fixed

coturnC

A widely-deployed TURN and STUN relay server for WebRTC NAT traversal.

2 advisories

GHSA addr_less_eq() compares IPv6 range endpoints byte-by-byte instead of numerically, letting an authenticated TURN client bypass denied-peer-ip / allowed-peer-ip IPv6 ranges (a TURN-specific SSRF) MediumACL bypass / SSRFCVE-2026-73213 Advisory · fixed

GHSA An authenticated client can grow the shared multiplex-peer demux table without limit in multiplex-peer mode Mediumresource exhaustion Advisory · fixed

LiveKitGo

Open-source, self-hostable WebRTC infrastructure (SFU) for real-time audio, video, and data.

14 fixed

PR #4782 MigrationDataCache buffered an unbounded number and size of reliable data packets during the 2-second migration window; now capped at 4 MiB with excess dropped Mediumunbounded buffering (DoS) Fixed independently

PR #4741 Data-track packet header parser allowed hdrSize to exceed buffer length, crashing the whole server process on a single malformed message from any joined participant CriticalOOB slice panic (DoS) Fixed independently

PR #4741 Integer wraparound in the same data-track header parser could also cause an out-of-bounds slice read/panic for large extension-size values Criticalinteger wraparound Fixed independently

PR #4739 Unclamped Dependency-Descriptor spatial/temporal IDs could index a fixed array out of bounds and crash the process Criticalarray index panic (DoS) Fixed independently

PR #4757 Unauthenticated, oversized Twirp request bodies were fully decoded before any bridge-grant check ran Highpre-auth body decode (DoS) Fixed independently

PR #4743 No maximum read-message size was configured on the client-facing signaling WebSocket, allowing unbounded memory growth from a single connection Mediumunbounded WS message (DoS) Fixed independently

PR #4750 Per-participant pendingTracks map grew without bound; a connection could add tracks without publishing them to exhaust server memory Mediumunbounded map growth (DoS) Fixed independently

PR #4742 Malformed TURN deny_peer_cidrs entries silently disabled the intended deny rule instead of failing closed MediumTURN config parsing Fixed independently

PR #4744 A single participant credential could open unlimited TURN relay allocations, exhausting the shared relay-port range for everyone else Mediummissing per-user quota (DoS) Fixed independently

PR #4758 DownTrack.handleRTCP spawned one goroutine per incoming RTCP NACK packet with no cap, letting a peer exhaust server resources Mediumunthrottled goroutine spawn (DoS) Fixed independently

PR #4756 Authentication failures logged and reflected raw bearer tokens and API-key identifiers back to the caller Lowcredential logging Fixed independently

PR #4749 A partially configured Prometheus Basic Auth (only username or only password set) silently left the metrics endpoint fully unauthenticated Lowauth misconfiguration Fixed independently

PR #4742 Whitespace-only external TURN secret files silently disabled dynamic credential validation LowTURN config parsing Fixed independently

PR #4742 TURN TTL configuration accepted negative values and overflowing duration conversions LowTURN config parsing Fixed independently

ntfyGo

Simple HTTP-based pub-sub notification service — send push notifications via a plain PUT/POST, no app-specific setup.

1 open PR

PR #1845 ACL and account revocation did not reliably cancel existing live/WebPush subscriptions, letting a revoked user keep receiving private-topic messages Highbroken access control Open · in review

No findings match the current filters.

Contribute

open to reports and PRs

Contribute

Found a false positive, a bug Argo missed, or want to sharpen a prompt? Reports and pull requests are genuinely welcome, the false-positive and false-negative reports most of all. Found a real vulnerability with Argo, or one it missed? Report it, and you'll be credited right here next to the finding.

Contributing guide Open issues Discussions