Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

CVE-2026-12860

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

UBUNTU-CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

CVE-2026-13506

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

PT-2026-76170

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application Denial of Service or to...

CVE-2026-12860: Improper Verification of Cryptographic Signature

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-13506: Uncontrolled Recursion

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-69247: Observable Timing Discrepancy

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

PT-2026-76540

This update for openssl-1 1 fixes the following issue - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712...

Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

[SECURITY] Fedora 44 Update: xen-4.21.2-1.fc44

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Debian dla-4711 : python3-starlette - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4711 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4711-1 [email protected]...

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-66053 affecting package thrift for versions less than 0.24.0-1

CVE-2026-66053 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...