500 matches found
Guzzle: Unbounded response cookies risk denial of service
Impact In affected versions, Guzzle's built-in CookieJar accepts any number of Set-Cookie header fields from one response, with no limit on the size of each field. When a later request matches the stored cookies, Guzzle places every match into one generated Cookie header without limiting the numb...
Linux Distros Unpatched Vulnerability : CVE-2026-64126
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is...
Linux Distros Unpatched Vulnerability : CVE-2026-64114
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum,...
Linux Distros Unpatched Vulnerability : CVE-2026-64102
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen,...
CVE-2026-64114
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...
CVE-2026-64114
CVE-2026-64114 affects the Linux kernel’s IPv4 raw path. In raw_send_hdrinc(), the code validates that the caller-supplied IPv4 header fits the message length, but it does not reject headers with ihl < 5 per RFC 791. As a result, locally constructed packets with an invalid Internet Header Leng...
CVE-2026-64114 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...
EUVD-2026-45799
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...
CVE-2026-64114
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...
CVE-2026-64114 ipv4: raw: reject IP_HDRINCL packets with ihl < 5
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...
CVE-2026-64102 RDMA/siw: Reject MPA FPDU length underflow before signed receive math
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...
CVE-2026-64102
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...
CVE-2026-63868
In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...
EUVD-2026-45757
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...
CVE-2026-63984
CVE-2026-63984 affects the Linux kernel, addressing an overflow in the IPv6 RPL SRH decompression path. The bug occurs in ipv6_rpl_srh_decompress(): hdrlen is computed as outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); since hdrlen is an 8-bit value, for n >= 127 the resu...
CVE-2026-63920
The CVE-2026-63920 entry describes a Linux kernel vulnerability in IPv6 extension header handling. The issue arises when ip6_datagram_recv_specific_ctl() builds IPV6_…cmsgs by trusting on-wire hdrlen (ptr[1]) during put_cmsg() length calculation. Although the write to hdrlen is in-bounds, reading...
EUVD-2026-45693
In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...
CVE-2026-63902
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...