CLEANSTART-2026-EI53048 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

Security vulnerability affects the rclone package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

OpenBao resource management error vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a resource management error vulnerability. This vulnerability arises from the rate limit quota subsystem’s failure to properly parse the role of form-encoded request bodies or forwarded certificates; as a result, quota rule...

HAProxy resource management error vulnerability

Versions prior to HAProxy 3.0.30, 3.2.26, 3.3.17, 3.4.6, and 3.5-dev9 contain a resource management error vulnerability. This vulnerability arises because the HTTP/1.1 chunked request parser repeatedly processes identical bytes without advancing its state, causing affected worker threads to...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail::extractinlineimages fails to validate the media type within inline image data URIs. Remote authenticated attacke...

CESNET Liyang processing logic error vulnerability

CESNET libyang versions 6.4.13 and earlier contain a logic error vulnerability. This vulnerability stems from an uninitialized pointer deallocation issue in the src/parserxml.c file within the lydxmlenvnetconfrpc function when parsing NETCONF RPC action envelopes. Peers with active NETCONF sessio...

Silicon Labs EmberZNet buffer error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises from an out-of-bounds write when processing malformed GetGroupMembership messages, potentially leading to a crash...

OpenBao input validation error vulnerability

Versions prior to OpenBao 2.6.3 contain an input validation error vulnerability. This vulnerability stems from an open redirection flaw in the UI’s OIDC identity provider, which may allow unauthenticated users to be redirected to destinations controlled by attackers, enabling phishing attacks or...

Bytecode Alliance wasmtime buffer error vulnerability

The Bytecode Alliance has identified a buffer error vulnerability in versions prior to 24.0.12, version 25.0.0 prior to 36.0.13, version 37.0.0 prior to 46.0.2, and version 47.0.0 prior to 47.0.3. This vulnerability arises because multiple Store APIs fail to verify whether objects belong to a...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance versions prior to 36.0.16, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1 contain a resource management error vulnerability. This vulnerability stems from waSTM time-wasi-http failing to enforce a write check limit on the WASIp2 outbound HTTP body, thereby allowing excessively...

PHP 7.4.33 State Corruption Mitigation

PHP version 7.4.33 contains state-corruption flaws in early request error handling. This source package rebuilds PHP for Ubuntu 20.04 and backports mitigations for CVE-2026-109618 and CVE-2026-109619...

Authlib input validation error vulnerability

Versions of Authlib from 1.3.1 up to but not including 1.9.0 contain a security vulnerability. This vulnerability arises because OctKey.importkey checks for asymmetric key markers only at byte zero. However, PEM loaders accept leading whitespace, comments, or byte-order markers, which may allow...

Bob Halley DNSPython resource management error vulnerability

Bob Halley: A resource management error vulnerability exists in dnspython versions prior to 2.9.0. This vulnerability arises because dns.name.fromwireparser fails to limit the number of jumps when processing DNS compressed pointer chains. Malicious DNS packets can force excessive pointer traversa...

MessagePack resource management error vulnerability

Versions of MessagePack prior to 1.2.3 contain a resource management error vulnerability. This vulnerability arises because the C extension fails to deserialize values when strictmapkey is set to True; as a result, decoded map values are leaked. Repeated malformed inputs can lead to unbounded...

Bytecode Alliance wasmtime input validation error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 through 48.0.4 and 49.0.0 through 49.0.2 contain an input validation error vulnerability. This vulnerability arises because the Wasi: HTTP implementation allows a guest to set the “between-bytes-timeout” request option to 0 and then directly...

Bytecode Alliance wasmtime numeric error vulnerability

Bytecode Alliance: Versions prior to 36.0.16, versions 37.0.0 through 48.0.3, and versions 49.0.0 through 49.0.1 contain a numerical error vulnerability. This vulnerability arises when wasmtime-wasi processes filesystem timestamps; the subsecond field of the atim or mtim value overflows into the...

Pascal Buchbinder mod_qos numerical error vulnerability

Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a numeric error vulnerability. This vulnerability arises from an off-by-one pointer calculation when merging request body parameters with existing URL query parameters. As a result, the query string is truncated during securit...

GitLab input validation error vulnerability

Versions 17.4 prior to GitLab EE 19.3.6, version 19.4 prior to 19.4.3, and version 19.5 prior to 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper access control during synchronization of approval rules, potentially allowing authenticated users to bypa...

National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

Versions 10.3 through 12.2 of the National Security Agency Ghidra Software Reverse Engineering Framework contain a resource management error vulnerability. This vulnerability arises because the ThemeReader.readZipTheme function fails to limit resource allocation when extracting theme ZIP entries...

Expat development team Expat resource management error vulnerability

The Expat development team identified a resource management error vulnerability in Expat versions 2.9.0 and earlier. This vulnerability stems from an overly delayed amplification of the billion laughs protection check within accountingDiffTolerated in xmlparse.c. An attacker can supply an XML...

Bytecode Alliance wasmtime input validation error vulnerability

In versions prior to Bytecode Alliance Wasmtime 48.0.4, there is an input validation error vulnerability. This vulnerability stems from the failure to validate the type of results returned by asynchronous callbacks, leading to a stack buffer overflow. A malicious visitor can write approximately 1...