CVE-2026-85721

A flaw was found in the AsyncHttpClient AHC library. A remote attacker, by sending a specially crafted, small compressed HTTP response, could exploit a vulnerability in the automatic response decompression mechanism. This flaw, caused by the lack of a cumulative output-size limit, allows the...

CVE-2026-61634

A flaw was found in the RabbitMQ Java client library. A malicious or compromised broker can send a method frame larger than the negotiated Advanced Message Queuing Protocol AMQP framemax value. This inconsistent validation causes the client to allocate and decode a protocol-invalid frame, leading...

CVE-2026-59275

A flaw was found in Spring AMQP. A remote attacker could send a specially crafted, hostile Advanced Message Queuing Protocol AMQP message. This message could bypass allowlist protections and trigger a StackOverflowError, leading to the termination of the entire consumer Java Virtual Machine JVM...

CVE-2026-47885

A flaw was found in Spring WebFlux. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. This oversight could allow a remote attacker to send excessively large multipart requests, potentially leading to resource exhaustion and ...

CVE-2026-47874

A flaw was found in the Reactor Netty HTTP server. A remote attacker can exploit this vulnerability by sending HTTP/1.1 pipelined requests over a single connection. This action causes the server to consume an excessive amount of memory, leading to a Denial of Service DoS...

Security Bulletin: This Power System update is being released to address CVE-2026-17413

Summary Power Systems Firmware is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Denegación de servicio no autenticada en routers ZTE que afecta a más de 140 000 dispositivos en todo el mundo más de 17 modelos Desglose técnico de CVE-2026-34473, publicado a partir del conjunto de divulgación original y de los artefactos de análisis de firmware. Sitio en vivo:...

vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service DoS. When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spellsoundfoldsofo function, causing the editor to crash...

CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a...

EUVD-2026-85414

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a...

EUVD-2026-85413

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-95842

The Moquette Java MQTT broker is vulnerable to a Denial of Service (DoS) condition in versions prior to 0.18.1 . The root cause is that SessionEventLoop.run only catches InterruptedException, and SessionEventLoopGroup fails to restart a terminated loop. Consequently, an MQTT command triggering an...

CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

EUVD-2026-85411

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

GHSA-5F42-97GR-VFHQ Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

moquette is reachable by untrusted MQTT clients anonymous by default, so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE I did not find one and do not...

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

moquette is reachable by untrusted MQTT clients anonymous by default, so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE I did not find one and do not...

CVE-2026-91865

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessiv...

CVE-2026-91863

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the...

EUVD-2026-85364

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...