91028 matches found
CVE-2026-104016
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...
CVE-2026-110747
ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...
CVE-2026-110747
The jackson-dataformat-protobuf library is vulnerable to an integer overflow in the ProtobufParser._readStringKey() method. When processing a protobuf map entry, the parser reads the length prefix of a string key into an attacker-controlled int and performs a bounds check using signed arithmetic....
EUVD-2026-111531
ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...
CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...
CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...
CVE-2026-99145: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned…
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable...
PT-2026-128252
An integer overflow in the MessagePackBufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-99118
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...
PT-2026-128111
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check mul overflow before calculating the firmware payload size. Reject zero-length payloads and zero...
PT-2026-128071
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high...
PT-2026-128287
An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply...
CVE-2026-104016: FasterXML jackson-dataformat-protobuf: ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and…
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...
PT-2026-127310
ProtobufParser. readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAX VALUE the addition overflows to a negative value and the check passes even when...
PT-2026-128286
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate...
TencentOS Server 4: xorg-x11-server (TSSA-2026:1240)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1240 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
CVE-2026-106971
The rybakit/msgpack library, specifically version v0.11.0 , is vulnerable to an integer overflow within the MessagePack\BufferUnpacker component. This flaw can be triggered by processing a crafted input , potentially allowing an attacker to cause a Denial of Service (DoS) . No specific remediatio...
EUVD-2026-112134
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...
PT-2026-127736
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...
CVE-2026-106971
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP...