CVE-2026-18649 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP...

CVE-2026-18649

CVE-2026-18649 affects the GStreamer project, specifically the gst-plugins-good package. The vulnerable components are the rtph264depay and rtph265depay RTP depayloaders, which fail to enforce a maximum size on the reassembly buffer during fragmented RTP packet processing. The root cause is unbou...

CVE-2026-18649 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP...

SUSE CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-71314

Nuxt (Vue.js framework) is affected by CVE-2026-71314 in versions 3.1.0 through 3.21.10 and 4.5.1. An unauthenticated attacker can trigger unbounded server-side rendering memory growth via a server island v-for prop (including vforToArray and related usage), leading to memory exhaustion and a Nux...

CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

GHSA-6HXR-MR5R-9836 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...

NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

EUVD-2026-51298

re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS...

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...

Linux Distros Unpatched Vulnerability : CVE-2026-68499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern...

DEBIAN-CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

CVE-2026-68499 concerns the re2 Node.js bindings. Affected component is the String.prototype.match implementation in re2 when using a global RE2 pattern that can match the empty string. The underlying issue is that the native matching cursor is not advanced in lib/match.cc, causing an infinite lo...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...