CVE-2026-84384

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a crafted HEIF or AVIF file containing malicious metadata or image data. This could cause the application to consume an unbounded amount of memory during...

CVE-2026-57228

A flaw was found in Suricata. A heap out-of-bounds read vulnerability exists in the SMTP MIME quoted-printable decoder. A remote attacker can send specially crafted SMTP traffic, causing a quoted-printable escape sequence to be split across traffic chunks. This can lead to a one-byte read past a...

HTTP Request/response Smuggling

Http4s is vulnerable to HTTP request/response smuggling. The vulnerability is due to Ember’s chunk decoder accepting malformed chunk-size values with leading plus or minus signs, which allows an attacker to exploit differences in chunk-boundary parsing by intermediaries to bypass controls, poison...

SUSE-SU-2026:23901-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. - CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. - CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetLis...

OPENSUSE-SU-2026:21911-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. - CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. - CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetLis...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

AZL-103422 CVE-2026-65634 affecting package erlang 26.2.5.21-6

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-65634

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

PT-2026-104835

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt ber:dec subidentifiers/3 in lib/asn1/src/asn1rtt ber.erl and the...

CVE-2026-65634: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

OPENSUSE-SU-2026:21925-1 Security update for keybase-client

This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder...