EUVD-2026-62398

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

libp2p: yamux connection DoS via oversized data frame

SummaryThe yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop t...

EUVD-2026-62363

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

CVE-2026-75900

An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...

PT-2026-78361

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description An Out-of-Bound write issue exists due to insufficient validation of attacker-controlled length fields during the deserialization of session files. When a crafted session file is loaded using the -s option, the...

CVE-2026-72330

A flaw was found in the Linux kernel's TLS Transport Layer Security implementation. A remote attacker could send specially crafted zero-length TLS application data records. This could cause the system to repeatedly process these empty records, blocking all subsequent legitimate data on the...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the readBytes method in src/main/java/com/rabbitmq/client/impl/ValueReader.java. An attacker can trigger a JVM OutOfMemoryError by sending an AMQP field or long string with a declared leng...

SUSE CVE-2026-68145

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

GO-2026-6172 WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active networ...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

EUVD-2026-61041

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

UBUNTU-CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

RLSA-2026:55679 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

SUSE CVE-2026-53792

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially craft...

SUSE CVE-2026-73051

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...