752 matches found
CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...
RUSTSEC-2026-0229 NIP-98 authorization parsing permits resource exhaustion
The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...
NIP-98 authorization parsing permits resource exhaustion
The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...
PT-2026-76513
The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...
CVE-2026-61536
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...
BIT-SQLITE-2026-51297
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
CVE-2026-51297
A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...
Kubernetes API Server - YAML Parsing DoS (Billion Laughs) Detection
The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. !/usr/bin/env python3 -- coding: utf-8 -- """The...
CVE-2026-51298
A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can...
Linux Distros Unpatched Vulnerability : CVE-2026-51297
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by...
CVE-2026-51298
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51297
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51297
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-49352
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
CVE-2026-51297
...
EUVD-2026-49353
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still accesses internal member of the freed pointer, which can cause service crash and denial of service...
CVE-2026-51297
This CVE entry is rejected/not used and does not represent an active vulnerability.
CVE-2026-51297
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
No title provided
A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...