UBUNTU-CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446 wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446 wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446 wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446

CVE-2026-5446 affects wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 sessions configured with --enable-aria and the proprietary MagicCrypto SDK. The issue is reuse of a 12-byte GCM nonce for every application-data record because wc_AriaEncrypt is stateless and passes the caller-provided IV directly, with the ...

CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

CVE-2026-5446

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the pngsetPLTE, pngsettRNS, and pngsethIST functions. An attacker can cause corrupted chunk metadata or leak heap contents by passing a pointer obtained from pnggetPLTE, pnggettRNS, or pnggethIST back into the...

CVE-2026-34757

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from pnggetPLTE, pnggettRNS, or pnggethIST back into the corresponding setter on the same...

glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

A flaw was found in glibc. When the wordexp function is called with the flags WRDEREUSE and WRDEAPPEND, it may return uninitialized memory. If the caller inspects the wewordv array or calls the wordfree function to free the allocated memory, the process will abort, resulting in a denial of servic...

wolfSSL 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the US company wolfSSL, aimed at developers working with embedded systems. There is a security vulnerability in wolfSSL: the ARIA-GCM cipher suite used in TLS 1.2 and DTLS 1.2 reuses the same 12-byte GCM random numb...

The vulnerabilities of the functions srpt_refresh_port() and srpt_cm_req_recv() in the drivers/infiniband/ulp/srpt/ib_srpt.c module of the server and client driver for the Linux operating system’s RTRS kernel, which allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the functions srptrefreshport and srptcmreqrecv in the drivers/infiniband/ulp/srpt/ibsrpt.c module of the server and client driver for the Linux operating system are related to the reutilization of previously released memory. Exploiting these vulnerabilities could allow an...

wasmtime 资源管理错误漏洞

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. Version 43.0.0 of Wastime contains a resource management vulnerability. This vulnerability stems from a flaw in cloning wastim::Linker, which may lead to reuse after reclamation...

The vulnerability in the amdgpu_cs_vm_handling() function of the drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c driver of the Direct Rendering Infrastructure (DRI) AMD GPU kernel for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the amdgpucsvmhandling function in the drivers/gpu/drm/amd/amdgpu/amdgpucs.c file of the Direct Rendering Infrastructure DRI AMD GPU kernel for the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an...

HDF5 资源管理错误漏洞

HDF5 is a library developed by the HDF open-source project. Versions of HDF5 such as 1.14.1-2 and earlier contained a resource management vulnerability. This vulnerability stemmed from the use of the h5dump auxiliary tool, where heap reclamation followed by reuse occurred. Providing a malicious h...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. Versions of Apache Airflow prior to 3.2 contained security vulnerabilities; these vulnerabilities stemmed from the failure to...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the JASPIAuthenticator. An attacker can gain unauthorized access or escalate privileges by exploiting residual ThreadLocal values that are not cleared after authentication...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the JASPIAuthenticator. An attacker can gain unauthorized access or escalate privileges by exploiting residual ThreadLocal values that are not cleared after authentication...

CVE-2026-5795

In Eclipse Jetty, the JASPIAuthenticator initializes authentication checks that set two ThreadLocal variables. After returning from these initial checks, the code may take an early return path without clearing the ThreadLocals. A subsequent request that executes on the same thread inherits these ...