CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

UBUNTU-CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-63209

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

CVE-2026-85228

A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent...

CVE-2026-93546

The Apache HTTP Server (version 2.4.68 and prior) is vulnerable to an integer overflow in the mod_dav_fs component. An authenticated WebDAV client with write access can crash worker processes and cause persistent corruption of a directory's property database. This is achieved by sending PROPPATCH...

CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-93546

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

EUVD-2026-90910

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

poppler: poppler: Denial of Service via integer overflow in SplashClip

A flaw was found in poppler. An integer overflow vulnerability exists in the SplashClip rendering component when handling path clipping operations. A local attacker could exploit this flaw by providing specially crafted input, causing the application to crash and resulting in a Denial of Service...

poppler: poppler: Data corruption via integer overflow in FoFiTrueType::cvtSfnts

A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and...

BIT-PHP-MIN-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-MIN-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-PHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-PGBOUNCER-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

BIT-LIBPHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-LIBPHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...