CVE-2026-90136 platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Reject negative power cap writes in hwmon hsmphwmonwrite takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATTPERMILLIWATT" to msg.args0, which is a u32. MICROWATTPERMILLIWATT is...

libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system...

libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system...

libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system...

Important: libevent

Issue Overview: Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmente...

Important: libevent

Issue Overview: Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmente...

EUVD-2026-76524

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

DEBIAN-CVE-2026-84966

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

httpc does not bound server-supplied numeric header values before integer conversion

...

eldap does not bound the port component of a referral URL before integer conversion

...

uri_string does not bound the port component of a URI before integer conversion

...

AZL-98457 CVE-2026-59696 affecting package erlang for versions less than 26.2.5.21-6

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...

CVE-2026-70409

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

UBUNTU-CVE-2026-59696

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...

CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

CVE-2026-70409

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

CVE-2026-59696

CVE-2026-59696 is an Improper Validation of Specified Quantity in Input flaw in Erlang/OTP stdlib where uri_string:get_port/1 passes the URI port substring to binary_to_integer/1 with no length bound. A syntactically valid port of up to ~1.26 million digits converts successfully, costing the call...