3161 matches found
CVE-2026-88884: Incorrect Authorization
Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...
PT-2026-89360
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...
PT-2026-89395
Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...
ai.konduit.serving:konduit-serving-api (>=0.0.2, <=0.3.0), ai.konduit.serving:konduit-serving-cli (>=0.0.2, <=0.3.0) +3471 more potentially affected by CVE-2026-87822 via com.tdunning:t-digest (>=3.0, <=3.3)
com.tdunning:t-digest MAVEN version =3.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.1.0, =j8.2.2.0, =j11.2.6.2 and more Source cves: CVE-2026-87822 Source advisory: SNYK:JAVA-COMTDUNNING-19659413...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through MergingDigest.fromBytes in core/src/main/java/com/tdunning/math/stats/MergingDigest.java. An attacker can trigger severe processing delays by supplying a crafted serialized digest containing Na...
CVE-2026-87822
A flaw was found in t-digest. A remote attacker can exploit a vulnerability in the MergingDigest.fromBytes deserialization process by injecting specially crafted "Not a Number" NaN values. These malicious values bypass validation checks, degrading sorting performance from efficient to significant...
CVE-2026-87822
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87822
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
UBUNTU-CVE-2026-87822
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87822 t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87822 t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
EUVD-2026-75020
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87822
t-digest versions 3.1 through 3.3 contain a denial-of-service vulnerability in MergingDigest.fromBytes . During deserialization, centroid means are not validated, allowing an attacker to inject NaN values that bypass existing checks. When such a malformed digest is merged, sorting performance deg...
Security Advisory 0182
Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...
PT-2026-89052
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87822: Inefficient Algorithmic Complexity
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance fr...
CVE-2026-87055
A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce...
SUSE-SU-2026:23690-1 Security update for tomcat10
This update for tomcat10 fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...
Security Bulletin: IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass.
Summary IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability
Summary SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component...