Summary
Stale copy of the public suffix list
We have identified that this project contains an out-of-date version of the Public Suffix List (https://publicsuffix.org/). We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences and journals. Our results will become publicly available after 21 days; this provides time to update your project with an up-to-date version of the Public Suffix List.
GitHub repository: gsemac/Gsemac.Common
Public Suffix List path: src/Gsemac.Net/Resources/public_suffix_list.dat
The Public Suffix List is regularly updated (generally a few times per week), and to ensure that the correct privacy boundaries are maintained between websites, applications that use it should routinely fetch an updated copy. If new suffixes are added to the list, and an old list is then used, privacy boundaries will not be constructed correctly, allowing for data (e.g., cookies) to be set incorrectly, potentially harming privacy.
There is further guidance on how the Public Suffix List should be used in ICANN’s “Advisory on the Use of Static TLD / Suffix Lists” at https://www.icann.org/en/system/files/files/sac-070-en.pdf.
If you have any questions about our research, or about usage of the Public Suffix List, please reply via e-mail to [email protected].
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-W4X6-HH3X-WJRX? GHSA-W4X6-HH3X-WJRX is a low-severity security vulnerability in Gsemac.Net (nuget), affecting versions < 0.38.2. It is fixed in 0.38.2.
- Which versions of Gsemac.Net are affected by GHSA-W4X6-HH3X-WJRX? Gsemac.Net (nuget) versions < 0.38.2 is affected.
- Is there a fix for GHSA-W4X6-HH3X-WJRX? Yes. GHSA-W4X6-HH3X-WJRX is fixed in 0.38.2. Upgrade to this version or later.
- Is GHSA-W4X6-HH3X-WJRX exploitable, and should I be worried? Whether GHSA-W4X6-HH3X-WJRX is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-W4X6-HH3X-WJRX is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-W4X6-HH3X-WJRX? Upgrade
Gsemac.Netto 0.38.2 or later.