Security Bulletin: IBM MQ is affected by multiple vulnerabilities in Bouncy Castle for Java

Summary IBM MQ has addressed multiple vulnerabilities in Bouncy Castle for Java Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value n the startRawBinary and finishRawBinaryLen methods of the NonBlockingByteArrayParser class. An attacker can crash the processing thread with an OutOfMemoryError or a NegativeArraySizeExceptio...

Memory Allocation with Excessive Size Value

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the ONNX model parser in onnx/defs/nn/defs.cc and related definition files, where a model can declare an extremely large tensor dimension e.g...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12185...

PT-2026-133027

Security vulnerability affects the grafana-alloy package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple BouncyCastle vulnerabilities (CVE-2026-13506, CVE-2026-14682)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD uses bouncy-castle to parse and load PEM format certs. CVE-2026-13506, CVE-2026-14682. Vulnerability Details CVEID:CVE-2026-13506 DESCRIPTION: In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This...

Astra Linux – vulnerability in Apache2

A memory allocation vulnerability with an excessively large value in Apache HTTP Server’s modhttp module can lead to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server versions 2.4.17 through 2.4.67...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM...

Security Bulletin:Vulnerabilities exists in Github package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-83530 DESCRIPTION: A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on th...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the APEv2 tag parser in APEv2Parser.ts, where a malicious audio file can specify an...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the ID3v2 tag parser in lib/id3v2/ID3v2Parser.ts, where a declared tag size in an ID3v2...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the EBML element parser in EbmlIterator.ts, where an attacker-controlled element length...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive...

Linux Distros Unpatched Vulnerability : CVE-2026-82458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang,...

Memory Allocation with Excessive Size Value

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via list, set, and map decoding in its Go protocol readers and generated decoders. An unauthenticate...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91366

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through SignatureSubpacketsReader.ReadPacket and UserAttributeSubpacketsReader.ReadPacket in the OpenPGP subpacket parsers. An attacker can trigger denial of service by supplying a crafted...