CVE-2026-49423

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

EUVD-2026-62344

When building the iovec array for a received TLS 1.2 CBC record, ktlsocftlscbcdecrypt incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. This left uninitialized entries in the iovec array. The iovec array was...

CVE-2026-49423

FreeBSD 's KTLS (Kernel TLS) subsystem contains an uninitialized memory access in ktls_ocf_tls_cbc_decrypt(). When building the iovec array for a received TLS 1.2 CBC record, the function incremented the index for every mbuf in the chain, including those skipped because they held only the 5-byte ...

CVE-2026-49419

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-49419 Jail reference count underflow

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-72334

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream handling. A remote attacker, by sending specially crafted malformed Bluetooth ISO packets, could trigger a kernel panic, leading to a denial of service. Additionally, this vulnerability could result in a memory leak within th...

CVE-2026-52739

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52738

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalizedstate/zebradb/transparent.rs, the finalized-state writer originally appli...

CVE-2026-52829 ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 ...

CVE-2026-52829

An unauthenticated remote peer can deterministically crash any synced zebrad node (v4.4.1 and earlier) on the default Linux dual-stack listener by completing a P2P handshake and advertising an invalid mempool transaction; the crash fires after the 30-second misbehavior batch flush due to an IPv4-...

CVE-2026-52731

ZEBRA (Zcash full node, Rust) versions prior to 4.5.0 are vulnerable to a denial of service via the getblocktemplate RPC endpoint. The LongPollId::from_str function in zebra-rpc/src/methods/types/long_poll.rs performs byte-index string slicing on user-supplied input. When the LongPollId contains ...

CVE-2026-52731 ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/longpoll.rs, LongPollId::fromstr...

CVE-2026-52738 ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalizedstate/zebradb/transparent.rs, the finalized-state writer originally appli...

CVE-2026-52738 ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalizedstate/zebradb/transparent.rs, the finalized-state writer originally appli...

CVE-2026-52738

Zebra (a Zcash node written in Rust) versions up to v4.4.1 are vulnerable to a persistent chain halt . The finalized-state writer in transparent.rs applies all credits before debits within a block, so a consensus-valid block with a long chain of transparent self-spends to one address can push the...

CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

CVE-2026-52739

Affected: zebrad up to v4.4.1. Root cause: Chain::push in zebra-state/src/service/non_finalized_state/chain.rs:1608-1628 inserts the transaction hash into tx_loc_by_hash with an assert_eq! before running the duplicate shielded-nullifier guard, so a repeated shielded transaction in a child block t...

CVE-2026-52739 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::push originally inserted the...

GO-2026-6115 WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...

GO-2026-6163 Panic on malformed XOR-MAPPED-ADDRESS attribute in github.com/pion/stun/v3

In github.com/pion/stun/v3 before 3.1.5, XORMappedAddress.GetFromAs reads the address family header from an XOR-MAPPED-ADDRESS attribute before validating the attribute length. Parsing a malformed STUN message carrying a zero-length XOR-MAPPED-ADDRESS attribute from a tightly sized buffer causes ...