National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

Versions of the National Security Agency Ghidra Software Reverse Engineering Framework prior to 12.2 contain a resource management error vulnerability. This vulnerability arises because FileSystemIndexHelper allows unrestricted resource allocation; as a result, TarFileSystem and ZipFileSystem sto...

Expat development team Expat resource management error vulnerability

The Expat development team identified a resource management error vulnerability in Expat versions 2.9.0 and earlier. This vulnerability stems from an overly delayed amplification of the billion laughs protection check within accountingDiffTolerated in xmlparse.c. An attacker can supply an XML...

Amazon aws-c-mqtt resource management error vulnerability

Versions of Amazon AWS-C-MQTT prior to 0.16.2 contain a resource management error vulnerability. This vulnerability stems from an excessively large value assigned to memory allocation size within the MQTT 3.1.1 compatibility adapter, potentially allowing remote attackers to cause denial of servic...

PHP 7.4.33 State Corruption Mitigation

PHP version 7.4.33 contains state-corruption flaws in early request error handling. This source package rebuilds PHP for Ubuntu 20.04 and backports mitigations for CVE-2026-109618 and CVE-2026-109619...

Bytecode Alliance wasmtime input validation error vulnerability

In versions prior to Bytecode Alliance Wasmtime 48.0.4, there is an input validation error vulnerability. This vulnerability stems from the failure to validate the type of results returned by asynchronous callbacks, leading to a stack buffer overflow. A malicious visitor can write approximately 1...

Smile Digital Health HAPI FHIR resource management error vulnerability

Smile Digital Health HAPI FHIR contains a resource management error vulnerability. This vulnerability stems from improper handling of highly compressed data, which may allow unauthenticated attackers to send compressed payloads. This could result in server heap exhaustion or cause certain service...

Hsiaoming Yang mistune resource management error vulnerability

Versions 3.0.0 through 3.3.0 of Hsiaoming Yang Mistune contain a resource management error vulnerability. This vulnerability stems from an algorithm complexity issue in the parselinktext function within src/mistune/helpers.py when handling deeply nested square brackets. Attackers can submit...

HAProxy resource management error vulnerability

Versions prior to HAProxy 3.0.30, 3.2.26, 3.3.17, 3.4.6, and 3.5-dev9 contain a resource management error vulnerability. This vulnerability arises because the HTTP/1.1 chunked request parser repeatedly processes identical bytes without advancing its state, causing affected worker threads to...

National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

National Security Agency Ghidra Software Reverse Engineering Framework versions 12.2 and earlier contain a resource management error vulnerability. This vulnerability arises from the failure to validate the length field in BinaryField.read, resulting in uncontrolled memory allocation. Attackers c...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance versions prior to 36.0.16, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1 contain a resource management error vulnerability. This vulnerability arises from insufficient accounting of host memory allocation when dynamically increasing guest values via the Val API; it bypasses...

Silicon Labs EmberZNet buffer error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises from an out-of-bounds write when processing malformed GetGroupMembership messages, potentially leading to a crash...

MongoDB C# Driver numeric error vulnerability

A numeric error vulnerability exists in MongoDB C Driver versions 2.0.0 through 3.13.0. This vulnerability stems from a flaw in the BSON processing library regarding numerical type conversion. Untrusted text inputs containing boundary values for binary subtype types can bypass integrity checks on...

Bytecode Alliance wasmtime resource management error vulnerability

In versions prior to 48.0.4 of Bytecode Alliance Wasmtime, as well as versions prior to 49.0.0 but prior to 49.0.2, there is a resource management error vulnerability. This vulnerability arises because the GC root protection is missing in trycall calls when compiling Wasm modules. An attacker can...

Pascal Buchbinder mod_qos numerical error vulnerability

Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a numeric error vulnerability. This vulnerability arises from an off-by-one pointer calculation when merging request body parameters with existing URL query parameters. As a result, the query string is truncated during securit...

PT-2026-134710

Security vulnerability affects the rclone package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

Apache Abdera input validation error vulnerability

All versions of Apache Abdera contain an input validation error vulnerability. This vulnerability stems from improper restrictions on XML external entity references. When the application uses Abdera to parse XML controlled by attackers, it may allow attackers to access sensitive data or initiate...

MongoDB C Driver numeric error vulnerability

Versions prior to MongoDB C Driver 1.30.14 and 2.5.7 contain a numeric error vulnerability. This vulnerability stems from a 32-bit integer wrap-around in Windows-specific Kerberos/SSPI authentication code. When excessively long credential values are provided in client connection configurations, a...

MongoDB C# Driver processing logic error vulnerability

Versions 1.8.0 through 3.13.0 of the MongoDB C Driver contain a logic error vulnerability. This vulnerability arises because, when determining whether two clients can share a cache connection, only the issuer and serial number are compared for TLS client certificates. As a result, an attacker who...

webpack-dev-server input validation error vulnerability

Versions prior to webpack-dev-server 5.2.7 and versions 6.0.0 through 6.1.0 contain an input validation error vulnerability. This vulnerability arises because when forwarding WebSocket requests via configuration proxy entries, no validation is performed on Host or Origin headers. As a result, the...

National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

Versions of the National Security Agency Ghidra Software Reverse Engineering Framework prior to 12.2 contain a resource management error vulnerability. This vulnerability stems from ExtensionUtils.unzipToInstallationFolder’s improper handling of highly compressed data. Attackers can trick users...