PT-2026-97559

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An authenticated stream client with read access to any stream...

PT-2026-97563

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the validate partitions function where it only verifies that the requested partition count is at least 1, withou...

PT-2026-97567

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.1 Description An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can cause significant CPU amplification through backtracking. This occurs becaus...

PT-2026-97579

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the HTTP handler of the rabbitmq stream management plugin where the accept...

Your Model Is Leaking: Covert Information Transfer through LLM Residual Streams

Privacy-sensitive organizations may run large language models LLMs in restricted or air-gapped environments while exporting selected diagnostic artifacts. We show that a compromised runtime component can hide sensitive information in intermediate activations that are allowed to leave the restrict...

CVE-2026-67240: Inefficient Regular Expression Complexity

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-67218: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...

CVE-2026-66072: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-66067: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

Linux Distros Unpatched Vulnerability : CVE-2026-63274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's o...

Linux Distros Unpatched Vulnerability : CVE-2026-92382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer...

PT-2026-105061

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get chunk selector/1 calls binary to atom on the raw client-supplied property from post-auth subscribe and resolve offset spec frames, with no whitelist and no existing guard. An authenticat...

PT-2026-105055

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check vhost access; it omits the node/vhost/user connection-limit checks that rabbit reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges...

GHSA-PG59-5VWG-4JXQ SIPGO: DoS via unvalidated Content-Length in the stream parser

Summary The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS. Details ParserStream.parseSingle allocates the body buffer from the declared Content-Length with no size check...

SIPGO: DoS via unvalidated Content-Length in the stream parser

Summary The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS. Details ParserStream.parseSingle allocates the body buffer from the declared Content-Length with no size check...

CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-58268

The sipgo library (versions prior to 1.4.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) via an oversized Content-Length header. The vulnerability exists in the ParserStream.parseSingle function within sip/parser_stream.go, where the library allocates a SIP body buffer based on th...

EUVD-2026-84817

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-64847

A flaw was found in AnyIO. Untrusted or faulty worker code can write a large amount of data to the standard error stderr stream. This data fills a pipe that the parent process fails to drain, causing the process-pool call to block indefinitely. This can lead to a Denial of Service DoS condition,...

SUSE CVE-2026-90425

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...