CVE-2026-20127

CVE-2026-20127 概要 Cisco Catalyst SD-WAN Controller の認証バイパス脆弱性 CVE-2026-20127 に対するエクスプロイトです。 このエクスプロイトは vbondprocchallengeackack ハンドラを標的とします。攻撃者が制御する verifystatus=1 バイトを含む偽造 CHALLENGEACKACK メッセージ（msgtype=10）を送信し、サーバーにピアエントリの authenticated=1 を直接強制的に設定させます。 仕組み 通常の DTLS コントロールプレーンハンドシェイクでは: 1...

CVE-2026-20127-Exploit-Extension

エグゼクティブサマリー CVE-2026-20127 Defensive Companionは、プロアクティブな脅威インテリジェンスと防御的分析のために設計された、エンタープライズ向けのプレミアムブラウザ拡張機能です。このツールは、Cisco Catalyst SD-WAN Controller（vSmart）における認証バイパスの脆弱性に関する権威ある技術研究をカプセル化しています。オフラインで高度にローカライズされたインテリジェンスレイヤーを提供することで、Security Operations...

CVE-2026-20182

CVE-2026-20182 — Cisco Catalyst SD-WAN Controller / Manager 認証バイパス Cisco Catalyst SD-WAN Controller vSmart および Manager vManage 上の vdaemon DTLS サービス UDP/12346 における重大な CVSS 10.0 認証バイパスである CVE-2026-20182 の概念実証エクスプロイトです。 公開: 2026年5月14日、Rapid7 Stephen Fewer & Jonah Burgess により公開 CISA KEV: 2026年5月14日に追...

CVE-2026-54874

A flaw was found in OpenSSL. Receiving a DTLS Datagram Transport Layer Security record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a...

CVE-2026-54874

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

CVE-2026-59646

A flaw was found in Bouncy Castle for Java. The DTLS Datagram Transport Layer Security handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive...

PT-2026-81301

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 4.0 Description Receiving a DTLS record for a future epoch during a handshake causes the system to buffer significantly more memory than the record requires. This occurs because the software retains the entire re...

Linux Distros Unpatched Vulnerability : CVE-2026-54874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.14)

The version of AOS installed on the remote host is prior to 7.3.1.14. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.14 advisory. - A flaw was found in gnutls. Servers configured with RSA-PSK RivestShamirAdleman Pre-Shared Key wrongfully matched usernam...

openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1994)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1994 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

CVE-2026-59646 DTLS handshake reassembler allocates buffer from unchecked 24-bit length

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

Linux Distros Unpatched Vulnerability : CVE-2026-59646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java...