CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382

Wasmtime versions 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 are vulnerable to a denial-of-service flaw within the wasi:http implementation. The root cause is that guests can specify a zero between-bytes-timeout request option, which is passed directly to a Tokio API that triggers a panic. Thi...

CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

EUVD-2026-108308

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

ROS-20261022-73-0046

The vulnerability of the rabbitmq-c library is related to incorrect checks of buffer boundaries on 32-bit systems when processing BYTES fields. Exploiting this vulnerability allows an attacker, operating remotely through a compromised AMQP broker, to compromise the confidentiality and accessibili...

PT-2026-121560

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

Node.js 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP...

SUSE CVE-2026-106070

A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When zipEntry.modified is read on an archive whose local header does not match its central directory, either directly or while...

CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

CVE-2026-114104

The adm-zip library before version 0.6.1 is vulnerable to an inconsistent entry resolution flaw. Attackers can bypass content validation by providing ZIP archives containing duplicate entry names . Specifically, the library's getEntry() method may return the last duplicate entry while the extract...

CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

EUVD-2026-105313

The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid...

The Brain ADM-ZIP for NodeJS processing logic has a vulnerability in its handling of errors.

The Brain ADM-ZIP for NodeJS versions prior to 0.6.1 has a processing logic vulnerability. This vulnerability stems from inconsistent entry parsing: the getEntry function returns the last duplicate entry, while the extractAllTo function writes the first duplicate entry. This allows attackers to...

CVE-2026-105941

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

EUVD-2026-104983

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...