93836 matches found
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...
GHSA-8VVX-RFF5-P5RQ Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...
CVE-2026-102822 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needsmac only when MAC selection fails. A remote peer can then send a packet with a...
CVE-2026-102822
The russh Rust SSH client and server library is vulnerable to a slice-index-out-of-range panic in versions prior to 0.63.1 . The root cause is a flaw in the selection logic where a connection configured to permit mac=none can incorrectly negotiate a MAC-requiring CTR or CBC block cipher. An attac...
CVE-2026-102822 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needsmac only when MAC selection fails. A remote peer can then send a packet with a...
CVE-2026-97912
A flaw was found in the Linux kernel's Arm Ethos-U accelerator driver. When the mapping of Static Random-Access Memory SRAM fails during device initialization, the driver fails to reset the memory size to zero. Consequently, a local user can submit processing jobs that access physical address zer...
CVE-2026-97910
A flaw was found in the Linux kernel. The Spreadtrum audio driver fails to validate buffer size parameters against fixed physical memory allocations during compressed audio stream operations. A local attacker with access to the audio device can supply oversized buffer configurations to trigger an...
Uncontrolled Resource Consumption
Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of Content Security Policy violation reports into memory, which allows an unauthenticated attacker to submit an oversized report and exhaust the application's heap, causing a...
EUVD-2026-71636
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol...
CVE-2026-102821
The Russh Rust SSH library (prior to version 0.63.2 ) is vulnerable to unbounded memory exhaustion during a client-stalled rekey. An authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and flood SSH_MSG_CHANNEL_OPEN messages. Because SessionKexState::InPr...
EUVD-2026-71634
undici vulnerable to Denial of Service via unbounded decompression of compressed responses...
CVE-2026-102809
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...
CVE-2026-102710
Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...
CVE-2026-102714
nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...
CVE-2026-102716
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...
EUVD-2026-71465
undici vulnerable to Denial of Service via WebSocketStream unclean close...
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...
NPM: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
NPM: joi: Quadratic regular-expression backtracking in Joi.string.isoDate vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.7...
GHSA-6H2X-M376-MQJQ joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...