EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

EUVD-2026-81939

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...

CVE-2026-90078 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the ByteArrayProtoReader32 fast path in wire-runtime/src/commonMain/kotlin/com/squareup/wire/ByteArrayProtoReader32.kt. An attacker can crash protobuf decoding by supplying a length-delimited field wit...

GHSA-9RM7-3QHH-H2MC Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decodeByteArray and ProtoAdapter.decodeByteString use the ProtoReader32 fas...

CVE-2026-25290 Integer Overflow or Wraparound in OOBM

Memory Corruption when validating large data buffers from external sources using addition to check buffer length...

CVE-2026-25275 Buffer Over-read in WLAN Firmware

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

Rclone 1.75.0 S3 Multipart Declared-Length Memory Exhaustion (CVE-2026-88045)

The version of Rclone installed on the remote host is 1.75.0. It is, therefore, affected by a denial of service vulnerability: - In streamed multipart mode, rclone serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data, which...

CVE-2026-90259: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...

CVE-2026-90067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

SUSE CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2026-63126

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or...

github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send a specially crafted AMQP Advanced Message Queuing Protocol message with a malformed field length. This can cause an integer overflow, leading to a runtime panic in the client process. Consequently, the client...

bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling

A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...

CVE-2026-77412 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such a...

CVE-2026-19667 Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

CVE-2026-19667 Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

DEBIAN-CVE-2026-89926

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, which is an int. The bounds check is done on the truncated value while the...

AZL-101558 CVE-2026-89864 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-89864

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...