24049 matches found
EUVD-2026-84353
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length large...
PT-2026-97019
Name of the Vulnerable Software and Affected Versions SIPGO versions prior to 1.4.1 Description An unauthenticated peer can cause a denial of service by sending a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length. The ParserStream.parseSingle function in...
ROS-20260922-73-0117
The vulnerability in haproxy2 is related to errors in processing parameter values related to input data length. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20260922-73-0130
The vulnerability in HProxy is related to errors in processing parameter values related to input data length. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20260922-73-0116
The vulnerability in HProxy is related to errors in processing parameter values related to input data length. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20260922-73-0129
The vulnerability in haproxy2 is related to errors in processing parameter values related to input data length. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: iperf3 (UTSA-2023-002138)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002138 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Tenable has extracted the preceding description block...
CVE-2026-58268: Memory Allocation with Excessive Size Value
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...
Updated nmap packages fix a security vulnerability
Denial of Service via Zero-Length TCP Option Packet. CVE-2026-72712...
CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...
CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...
CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...
SUSE CVE-2026-88045
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...
K000163359: Python vulnerability CVE-2026-30922
Security Advisory Description pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containi...
netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...
PT-2026-96273
Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver affected versions not specified Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task function. For control frames, the driver uses the 16-bit TLV field...
Linux Distros Unpatched Vulnerability : CVE-2026-93560
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integ...
BIT-RCLONE-2026-88045 rclone: S3 multipart declared-length memory exhaustion
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...
DEBIAN-CVE-2026-63449
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...
