5358 matches found
CVE-2026-87029
A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service DoS by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandle...
Astra Linux – Vulnerability in Ruby 2.5
The attack vector is a potential Denial of Service DoS attack. The vulnerability arises from an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can create a malicious DNS packet containing a highly compressed domain name. When the resolv library...
Astra Linux – Vulnerability in freerdp3
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, the progressivedecompresstileupgrade function detected mismatches using progressiverfxquantcmpequal, but only emitted a WLogWARN message; execution continued. The wrapped value 247 was used as a shift...
Astra Linux – Vulnerability in snappy-java
Snappy-Java is a Java port of the snappy, a fast C++ compressor/decompressor developed by Google. It was found that the SnappyInputStream is vulnerable to Denial of Service DoS attacks when decompressing data with a too large chunk size. Due to a lack of a upper bound check on the chunk length, a...
Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82041)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
MiracleLinux 9 : python-tornado-6.5.10-1.el9_8.1 (AXSA:2026-2053:04)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2053:04 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block...
Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82040)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly fr...
RLSA-2026:82041 Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
python-tornado security update
An update is available for python-tornado. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...
RUSTSEC-2026-0348 Brotli certificate decompression can allocate up to 1 GiB before authentication
The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...
RLSA-2026:82040 Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
python-tornado security update
An update is available for python-tornado. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...
CLEANSTART-2026-QO62654 DOS / potential heap overwrite in mkv demuxing using bzip decompression
Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using bzip decompression...
CLEANSTART-2026-SR74236 DOS / potential heap overwrite in qtdemux using zlib decompression
Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in qtdemux using zlib decompression...
CLEANSTART-2026-VZ54058 DOS / potential heap overwrite in mkv demuxing using zlib decompression
Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using zlib decompression...
CLEANSTART-2026-MO53582 DOS / potential heap overwrite in mkv demuxing using lzo decompression
Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using lzo decompression...
RockyLinux 9 : python-tornado (RLSA-2026:82040)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
RockyLinux 10 : python-tornado (RLSA-2026:82041)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
