UBUNTU-CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91366

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633

A vulnerability exists in the Apache Thrift Dart bindings (versions before 0.25.0 ) where an unauthenticated remote attacker can trigger a Denial of Service (DoS) condition. The flaw occurs when sending input with inconsistent length parameters , specifically causing the TBinaryProtocol.readMessa...

CVE-2026-102731

The Apache Directory LDAP API (versions 1.2.0 before 1.2.9 ) is vulnerable to a memory allocation flaw caused by an excessive size value during BER decoding . A malicious peer or Man-in-the-Middle (MITM) actor can send a small BER-encoded response that triggers a large memory allocation before da...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

EUVD-2026-91333

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

SUSE-SU-2026:4414-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. - CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted bsc1280590. - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

SUSE-SU-2026:4413-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. - CVE-2026-75805: NULL Pointer Dereference in CMP Client...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

SUSE-SU-2026:4412-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. - CVE-2026-75805: NULL Pointer Dereference in CMP Client...

CVE-2026-83745: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

PT-2026-104200

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D language bindings contain multiple issues, including improper handling of length parameter inconsistency, uncaught...

PT-2026-104285

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Language bindings for Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D fail to cap size fields during deserialization. This allows a remote client to send an excessively large...

CVE-2026-82458: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...