CVE-2026-116013 OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-116013 OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-116013 OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection and decodename that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raisi...

CVE-2026-116013

The OpenResty lua-resty-dns library, in versions prior to 0.24 , is vulnerable to a Denial of Service attack. The root cause is an improper input validation flaw within the parse_section() and _decode_name() functions, which fail to verify resource record lengths against the received message. An ...

php: PHP: Denial of Service via heap buffer overflow in SOAP client

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

Apache jclouds 2.7.0 XML External Entity Injection

Apache jclouds version 2.7.0 contains an XML External Entity injection vulnerability in provider-response parsing that may allow local file disclosure or server-side request forgery when a parsed endpoint is attacker controlled. !/usr/bin/env bash Apache jclouds 2.7.0 XML External Entity XXE...

Rocky Linux 10.2 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_19061)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619061 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyadd...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc (crlsa-2026_2410)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262410 advisory. libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response CVE-2026-1761 Tenable has extracted the preceding description...

Rocky Linux 10 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_19061)

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619061 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyaddr...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_2182)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262182 advisory. libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-0719 libsoup: Stack-Based...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2026_2216)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262216 advisory. libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication CVE-2026-0719 libsoup: Stack-Based Buffe...

Rocky Linux 9 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_20597)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620597 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyaddr...

CVE-2025-14181

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

php: PHP: Denial of Service via heap buffer overflow in SOAP client

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

EUVD-2026-61175

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

PT-2026-77289

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendor standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call net buf linearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then writ...

PT-2026-73431

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...