328 matches found
CVE-2026-106808
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...
CVE-2026-106806
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
CVE-2026-106808
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...
PT-2026-135543
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
EUVD-2026-115352
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
CVE-2026-106808
OpenAirInterface Core Network v2.2.1 is affected by a stack-based buffer overflow in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The vulnerability occurs because the UDM passes attacker-controlled resynchronizationInfo.rand and auts values to the conv::hex_str_to_uint8() fun...
CVE-2026-106806
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
CVE-2026-106808: n/a: OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU…
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...
PT-2026-135544
Name of the Vulnerable Software and Affected Versions OpenAirInterface Core Network version 2.2.1 Description A stack-based buffer overflow exists in the OAI CN5G UDM 'Nudm UEAU Generate Authentication Data' endpoint. The issue occurs when the UDM passes attacker-controlled...
CVE-2026-106808
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...
EUVD-2026-115351
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM NudmUEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hexstrtouint8, which converts arbitrary-length hex string...
CVE-2026-106806: n/a: A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
CVE-2026-106806
A memory exhaustion vulnerability exists in Open5GS v2.8.0 within the HTTP/2 SBI server . The issue stems from repeated header names causing previously allocated header strings to be leaked; notably, HPACK compression enables an unauthenticated remote attacker to trigger tens of thousands of dupl...
CVE-2026-106806
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...
CVE-2026-99171
In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...
SUSE CVE-2026-99174
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...
AZL-111326 CVE-2026-99174 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...
DEBIAN-CVE-2026-99174
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...
CVE-2026-99174 ext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...
CVE-2026-99174 ext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...