Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not...

GHSA-97R2-QH9M-474H Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not...

npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

npm: Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length vulnerability discovered by ? in WordPress npm seroval versions = 1.4.1, = 1.6.7...

GHSA-WP97-X4HV-QVHP Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

CVE-2026-111108

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111108

Apache Kafka is vulnerable to a memory exhaustion flaw in its code-generated protocol readers. The root cause is that readers pre-size collections based on a sender-declared element count that is only validated against the remaining buffer bytes. This allows an attacker to declare a count far exc...

CVE-2026-111108 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111108

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

SUSE CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879

The jackson-databind library (com.fasterxml.jackson.core:jackson-databind from version 2.10.0 and tools.jackson.core:jackson-databind from version 3.0.0 ) contains a PolymorphicTypeValidator bypass. The vulnerability occurs because the library validates the outer class of a class-name type ID but...

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

PT-2026-128183

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod set array value complex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip set multiple, gpiod set array value returns abruptly, bypassing the freeing of...

PT-2026-128292

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111108: Allocation of Resources Without Limits or Throttling

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146623 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and...

Apache Kafka input validation error vulnerability

Security vulnerabilities exist in Apache Kafka versions 0.10.0.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. These vulnerabilities arise because multiple deserialization paths directly use size or count fields in input to allocate arrays, collections, or byte buffers; no validati...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146658 advisory. In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...