PT-2026-96421

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: fix hardware header length for NBMA tunnels ip6gre tnl link config route accumulates the lower device's hardware header length into dev-hard header len whenever header ops is set. This is incorrect for both users of head...

PT-2026-90211

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the o2dlm receive handlers trust length and count fields from the wire without proper bounding. This allows a malicious or compromised node that has joined the DLM...

PT-2026-90459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists where the nsm sendrecv msg locked function stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the...

PT-2026-96367

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata scsi write same xlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is buil...

PT-2026-90137

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the IPMB Intelligent Platform Management Bus component where the ipmb write function reads message fields before validating the length byte. This can lead to the reading o...

PT-2026-90063

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the mt7996 driver where the default EEPROM firmware is parsed and copied without verifying its length. If a truncated file is used, the driver may read beyond the firmware...

Linux Distros Unpatched Vulnerability : CVE-2026-88045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed...

CVE-2026-89586: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

PT-2026-90266

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the svcauth gss unwrap priv function only validates the upper bound of the wire-supplied opaque length len before passing the buffer to gss...

PT-2026-90061

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the DS28E17 1-Wire to I2C bridge where the w1 f19 i2c master transfer function fails to properly validate the length of data received during an I2C M RECV LEN read...

PT-2026-90103

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the ALSA 6fire driver where the usb6fire comm receiver handler function forwards MIDI events using a length byte provided by the device without proper bounds checking. The...

org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

rclone: S3 multipart declared-length memory exhaustion

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...

GHSA-2P48-J3QC-RX9F rclone: S3 multipart declared-length memory exhaustion

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...

CVE-2026-49838

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-49838 GoBGP confederation validation panics on empty AS_PATH attribute

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

DEBIAN-CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-88054

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...