Research — ba-cybersecurity.com

Recent

31 Oct 2026 · FreeRADIUS

A gap in TEAP verification was reported and fixed

A review of the TEAP Crypto-Binding code found a path that accepts a client without verifying any MAC. It was reproduced on the stable release 3.2.10 and reported, and the developers changed it to reject. In the development branch another check stops this path from being reached.

Reported 30 Oct, fixed 31 Oct (JST)More →

Web application defense

Predicting a configuration change before deploying itIn preparation

Whether a change to OWASP CRS settings will cause false positives or lose detection, known before it goes live. Prospective validation is in preparation.

WAF Rule WatchLive

Public rule updates from WAF vendors, and which actively exploited CVEs their texts name, tracked daily.

Open the radar →

Verifying Internet standards

CRIWith the authors

A CRI reference and its URI form could resolve to different addresses. 3 mismatches with RFC 3986 were shown with counterexamples and fixes, one fix proved in Lean 4. An author said they will be corrected before publication.

[1, ["", "a"]] against s://h/b/c §5.3 s://h/b//a §6.1 + 3986 s://h/a

CRI: check it by hand

Base s://h/b/c, reference [1, ["", "a"]] §5.3 resolves the reference s://h/b//a §6.1 converts it to the URI reference /a, and RFC 3986 resolves that s://h/a One reference, two different results.

Draft §5.3 · Draft §6.1

List post Preprint Code Proof

ASRAWith the authors

BGP path verification could mark a correct route Invalid. This was shown with a counterexample and a fix proved in Lean 4. An author said the algorithm will be revised.

correct route AS0, AS3, AS2 -05 Invalid fix not Invalid

ASRA: check it by hand

Route AS0 → AS3 → AS2 → AS1 Up to a provider, across to a peer, down to a customer: no leak. Only AS3 publishes: an ASPA, and an ASRA listing AS2 as a lateral peer. AS0 and AS2 have no ASPA, so min_up_ramp = 1, min_down_ramp = 1, N = 3. Step 4 checks i from (min_up_ramp + 1) to (N - min_down_ramp), so i = 2. AS(2) = AS3 asserts that AS(3) = AS2 is a lateral peer. -05 Invalid fix start at max_up_ramp + 1 = 3: nothing to check, not Invalid

Draft §4.2, Algorithm A

List post Preprint Code Proof

SUITWith the authors

A firmware condition for a final release also accepted its prereleases. This was shown with a counterexample checkable by hand. An author confirmed the error and is holding the next revision while a fix is reviewed; an exhaustive check and a Lean 4 proof support the proposed fix.

Equal [1,2,3] against 1.2.3-alpha.4 draft matches SemVer lower than 1.2.3

SUIT: check it by hand

§4.4.1 1.2.3-alpha.4 = [1,2,3,-3,4] §4.4 comparison "stops after all integers in the array defined by the manifest have been consumed" Equal [1,2,3] against 1.2.3-alpha.4 1 = 1, 2 = 2, 3 = 3, array consumed, stop draft matches SemVer §11 1.2.3-alpha.4 is lower than 1.2.3

Draft §4.4 · SemVer §11

List post Code Proof

Reviewing widely used software

FreeRADIUSFixed

TEAP could accept a client without verifying any MAC. Reproduced on 3.2.10 and reported; the developers fixed it and credited the report.

Fix commit

LangfuseFixed

Any organization member could invite users, without the required role, by naming a project from another organization. Reported; the developers fixed it and listed the report in their acknowledgements.

Fix PR Acknowledgements

Other projectsWith the developers

Problems have been reported to several projects and are being reviewed. They will be added here once fixed.

Open values in symmetric cryptography

Ascon: fewer active S-boxesPreprint

Lowered the best published active S-box counts we could find for NIST's lightweight standard. One pair of states follows all four rounds, and anyone can check it in a minute; 5 rounds have only a per-round check. Neither threatens the security of Ascon.

4 rounds

Designers

Best in 2022

This work

5 rounds

Designers

Best in 2022

This work

0active S-boxes80

Ascon: check it yourself

$ python3 verify/check.py round 8: 15 active S-boxes round 9: 11 active S-boxes round 10: 9 active S-boxes round 11: 7 active S-boxes total: 42 matches the characteristic: True Best published value we could find: 43. One pair of states, no dependencies, about a minute.

verify/check.py

Preprint Code Proof

SPECK128, 12 roundsComputing

Checking whether weight 66 is optimal. If every range has no solution, it is.

No solution: 27Computing: 9