6099 matches found
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
Improper Validation of Specified Type of Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...
SUSE-SU-2026:3058-1 Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. - CVE-2026-52720: inval...
SUSE CVE-2026-58250
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by...
JLSEC-2026-670
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...
JLSEC-2026-698 Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding...
Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...
JLSEC-2026-734 Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer
Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsipStoreMessage the capacity check guarding the fixed message bag MSGBAGSIZE sets an error code but fails to return, so execution falls through to an XMEMCPY that writes past the end of the buffer once the accumulated TLS 1.3...
JLSEC-2026-673
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...
JLSEC-2026-737 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
GHSA-CM26-5974-52H8 nebula-mesh: Certificate revocation is never enforced at the mesh
Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the pki.blocklist list in config.yml no CRL/OCSP. The project's own code states this...
BIT-NATS-2026-58250 NATS Server: Pre-auth server crash via double INFO in leafnode handshake
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by...
EUVD-2026-43716
Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive...
CVE-2026-12707
CVE-2026-12707 affects Cloudflare quiche. After QUIC handshakes, an attacker can trigger unbounded queuing of PathEvent::ReusedSourceConnectionId during rapid source address migration, causing memory resource exhaustion. Affected component is quiche’s PathEvents collection (path_event_next() drai...
PT-2026-58061
Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive...
PT-2026-64460
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...
On the Security Implications of PQC in TLS: Handshake Exhaustion and IDS Degradation
Post-Quantum Cryptography PQC is increasingly being integrated into TLS 1.3 to enhance resilience against quantum-enabled attacks. However, the additional computational and communication overhead introduced by PQC primitives during the handshake phase may also amplify the impact of TLS handshake...
EulerOS 2.0 SP10 : gnutls (EulerOS-SA-2026-2650)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security DTLS packet reordering logic. The...