CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

EUVD-2026-51021

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

PT-2026-66410

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Node.js main Description A flaw in the Permission Model enforcement allows for the over-granting of filesystem access across radix-tree prefix boundaries. When the --permission...

EUVD-2026-50084

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

EUVD-2026-46376

Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in radix.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

EUVD-2026-46354

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-65063 Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in radix.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-59141

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-59141 Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-59141

Data::RadixTree::Shared on Perl is affected in versions before 0.02 by an out-of-bounds read caused by trusting unvalidated node records after rdx_validate_header. The code validates the header but not the node records; rdx_find_locked may dereference nodes[cur].children[k] and read label_off/lab...

PT-2026-62044

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...

EUVD-2026-45770

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

The vulnerability of the __radix_tree_create() function in the net/qrtr/af_qrtr.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the radixtreecreate function in the net/qrtr/afqrtr.c module of the Linux operating system is related to the failure to release resources after the expiration of their useful life. Exploiting this vulnerability could allow an attacker to cause a service failure...

Node.js: Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant

A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary...

SUSE CVE-2026-43041

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: replace qrtrtxflow radixtree with xarray to fix memory leak radixtreecreate allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree...

Linux Distros Unpatched Vulnerability : CVE-2026-43041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: qrtr: replace qrtrtxflow radixtree with xarray to fix memory leak radixtreecreate allocates and links intermediate nodes into the tree one by one. If a...

CVE-2026-43041

A flaw was found in the Linux kernel's qrtr networking module. This vulnerability occurs when the radixtreecreate function allocates intermediate nodes that are not properly reclaimed if subsequent memory allocations fail. This leads to orphaned internal nodes and a memory leak. This memory leak...

CVE-2026-43041

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: replace qrtrtxflow radixtree with xarray to fix memory leak radixtreecreate allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree...

CVE-2026-43041

CVE-2026-43041 concerns the Linux kernel: the irq/qrtr path (qrtr_tx_flow) used a radix_tree that could leak memory when intermediate nodes were linked but a subsequent allocation failed. The root cause was orphaned internal radix_tree nodes left behind because radix_tree_for_each_slot() only vis...