CVE-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

CVE-2026-13069

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

EUVD-2026-47792

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

CVE-2026-13069

An authenticated user can trigger resource exhaustion in MongoDB Server by sending a crafted Queryable Encryption (FLE2) find payload that uses an unvalidated field to drive an internal computation loop. This causes excessive CPU and potential out-of-memory, degrading availability for other opera...

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

CVE-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

EUVD-2026-47586

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

PT-2026-63466

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

Oracle Linux 10 : tomcat (ELSA-2026-18537)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18537 advisory. - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Paddi...

PT-2026-63473

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

UBUNTU-CVE-2026-55868

Encryption State Machine Downgrade...

DEBIAN-CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517 Libarchive: libarchive: signed integer overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517

The CVE-2026-16517 entry concerns libarchive’s ZIP writer. The issue is a signed integer overflow in archive_write_zip_header when ZIP encryption is enabled and the entry size is near INT64_MAX, causing the addition of encryption overhead to overflow int64_t. This leads to undefined behavior, pot...

CVE-2026-16517 Libarchive: libarchive: signed integer overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

CVE-2026-16517

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...