Incorrect Calculation

Overview Affected versions of this package are vulnerable to Incorrect Calculation via the tcnwritetobytebuffer callback in the BIO write process. An attacker can cause queued post-handshake records to truncate flights, fail connections, or abort the JVM process by sending specially crafted TLS 1...

Incorrect Calculation

Overview Affected versions of this package are vulnerable to Incorrect Calculation via the tcnwritetobytebuffer callback in the BIO write process. An attacker can cause queued post-handshake records to truncate flights, fail connections, or abort the JVM process by sending specially crafted TLS 1...

UBUNTU-CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

EUVD-2026-109911

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

PT-2026-123394

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn write to bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-107726

Hazelcast is vulnerable to an arbitrary memory access flaw in versions prior to 5.4.5, 5.5.10, 5.6.1, and 5.7.0 . The root cause is improper validation of data supplied by a malicious client capable of connecting to a cluster. An attacker can perform arbitrary reads from a cluster member's Java h...

PT-2026-108287

Name of the Vulnerable Software and Affected Versions Hazelcast versions prior to 5.4.5 Hazelcast versions prior to 5.5.10 Hazelcast versions prior to 5.6.1 Hazelcast versions prior to 5.7.0 Description Improper validation of data supplied by a malicious client allows arbitrary reads from a clust...

CVE-2026-35582

Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The INFILEENDING and...

Exploit for CVE-2025-22167

README — CVE-2025-22167 Atlassian Jira For defensive us...

EUVD-2019-0543

Malware in sbrugna...

EUVD-2025-14031

Malicious code in bioql PyPI...

CVE-2025-1948

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to...

CVE-2025-1948 Eclipse Jetty HTTP clients can increase memory allocation

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to...

CVE-2025-1948 Eclipse Jetty HTTP clients can increase memory allocation

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to...

CVE-2025-1948

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to...

Hotdog Elevation of Privilege Vulnerability

Hotdog is a set of OCI hooks for injecting Log4j Hot Patch into containers. An elevation of privilege vulnerability exists prior to Hotdog version 1.0.1 that stems from not mimicking the functionality of the target JVM process or SELinux tags. An attacker could use this vulnerability to allow...

CVE-2022-0071

CVE-2022-0071 documents confirm an incomplete fix for CVE-2021-3101 in Hotdog prior to v1.0.2. The vulnerability arises because Hotdog did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. As a result, a container could exhaust host resources, modif...

CVE-2021-3101

Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container...