Poco vulnerabilities

2 known vulnerabilities in Poco from Pocoproject. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Poco: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2025-45766Aug 6, 2025Pocoproject

  poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and

• 9.8 Critical severity

  Poco: Integer Overflow or Wraparound

  CVE-2023-52389Jan 27, 2024Pocoproject

  UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80