CVE-2025-22868 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2025-22868 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2025-22868

CVE-2025-22868 is confirmed across connected feeds as a memory‑consumption DoS in token parsing caused by a malformed token in a Go oauth2/token path. The Astra Linux bulletin ties this to golang-golang-x-oauth2, and CBLMariner notes affected moby-engine versions below 25.0.3-11 with a patched re...

CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2022-49052 mm: fix unexpected zeroed page mapping with zram swap

In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONEVM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO...

CVE-2022-49052

In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONEVM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO...

CVE-2022-49052 mm: fix unexpected zeroed page mapping with zram swap

In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONEVM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO...

CVE-2022-49052

Summary (CVE-2022-49052) : The Linux kernel memory management path mm/page_io.c with zram swap could expose zeroed data to a process during CLONE_VM cloning, leading to potential data corruption. The root cause was the bogus swap_slot_free_notify in the CLONE_VM scenario, which didn’t correctly t...

Google Go 安全漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from unexpected memory consumption when parsing malicious malformed tokens...

PT-2025-8665

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An issue exists where an attacker can pass a malicious malformed token, causing unexpected memory consumption during parsing. Recommendations At the moment, there is no information about a new...

CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

PT-2025-7796

Name of the Vulnerable Software and Affected Versions Go JOSE versions 4.0.0 through 4.0.4 Description The issue is related to excessive memory consumption when parsing compact JWS or JWE input. The code uses strings.Splittoken, "." to split JWT tokens, which is vulnerable to excessive memory...

Go JOSE 安全漏洞

Go JOSE is a Go JOSE open source implementation of the JOSE standard in Go. A security vulnerability exists in Go JOSE versions 4.x up to and including 4.0.5, which stems from excessive memory consumption. An attacker exploiting this vulnerability could cause a denial of service by sending a...

CVE-2025-26466

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to ...

PT-2025-7169

Name of the Vulnerable Software and Affected Versions OpenSSH versions 9.5p1 through 9.9p1 Description The issue is related to an uncontrolled consumption of resources in OpenSSH, which can be exploited by a remote attacker to cause a denial of service. This can be achieved through memory...

OpenSSH 9.9p1 Denial of Service / Man-In-The-Middle Vulnerability

OpenSSH versions 6.8p1 to 9.9p1 contain a logic error that allow an on-path attacker a.k.a man-in-the-middle to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. OpenSSH versions 9.5p1 to 9.9p1 are vulnerable to a memory/CPU denial of service relat...

Denial Of Service (DoS)

Apache James Server is vulnerable to Denial of Service DoS. The vulnerability is due to unbounded memory consumption due to the JMAP HTML-to-plain-text conversion implementation failing to properly limit resource usage, potentially leading to service disruption...

Azure Linux 3.0 Security Update: libsoup (CVE-2024-52532)

The version of libsoup installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-52532 advisory. - GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain...

EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2025-1160)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored,...