95 matches found
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed key parsing memory leak. In rxrpcpreparsexdryfsrxgk, the memory associated with token-rxgk can be leaked in several error paths after it is allocated. This issue was addressed by freeing this memory in the...
CVE-2026-44167
phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files eg. X509 certificates, RSA PKCS8 private or public keys, etc. This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52...
CVE-2026-31643
A flaw was found in the Linux kernel's rxrpc subsystem. During key parsing, a memory leak can occur in certain error paths. This vulnerability could allow a local or remote attacker to cause a denial of service by exhausting system memory...
CVE-2026-31643
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
CVE-2026-31643
CVE-2026-31643 covers a Linux kernel rxrpc memleak in the key parsing path. In rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk could leak on several error paths after allocation. The issue is mitigated by freeing the allocated memory in the reject_token: path. Technical cover...
CVE-2026-31643
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
CVE-2026-31643 rxrpc: Fix key parsing memleak
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
EUVD-2026-25536
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
CVE-2026-31643 rxrpc: Fix key parsing memleak
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
CVE-2026-31643
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix key parsing memleak In rxrpcpreparsexdryfsrxgk, the memory attached to token-rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "rejecttoken:" case...
PT-2026-34995
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the rxrpc key parsing process. Specifically, in the rxrpc preparse xdr yfs rxgk function, memory attached to the token-rxgk variable can be leaked in several erro...
CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
fast-jwt provides fast JSON Web Token JWT implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patch...
CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33936 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Prior to version 0.19.2, an issue in the low-level D...
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations e.g., verify and encryption to collapse to...
CVE-2026-4603
CVE-2026-4603 affects jsrsasign versions before 11.1.1. The vulnerability stems from the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js, which can cause division by zero and collapse RSA public-key operations (e.g., verify/encrypt) to d...
Security Bulletin: IBM Storage Ceph is vulnerable to Improper Handling of Syntactically Invalid Structure in Grafana (CVE-2025-22865)
Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2025-22865 Vulnerability Details CVEID:CVE-2025-22865 DESCRIPTION: Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key i...
TencentOS Server 3: idm:DL1 (TSSA-2022:0117)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0117 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...