645771 matches found
CVE-2026-71224
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images. Mitigatio...
EUVD-2026-70450
A heap out-of-bounds read vulnerability was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem...
EUVD-2026-70447
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...
CVE-2026-71219 Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...
CVE-2026-71219
gfs2-utils contains a stack overflow in the hash table traversal code of metawalk.c . The function alloca() is called with an exponentially derived size (1 <
CVE-2026-71219
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...
CVE-2026-47863
A flaw was found in Reactor Core. Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang an...
CVE-2026-47857
A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service DoS condition. This could cause applications to become unresponsive or crash. Mitigation Mitigation for this...
RLSA-2026:62578 Important: go-fdo-server security update
This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location...
go-fdo-client security update
An update is available for go-fdo-client. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list go-fdo-client is the device-side implementation of FIDO Device Onboard...
php security, bug fix, and enhancement update
An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...
go-fdo-server security update
An update is available for go-fdo-server. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This package provides a server-side implementation of the FIDO Device...
RLSA-2026:62577 Important: go-fdo-client security update
go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...
Important: Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
CVE-2026-85150
CVE-2026-85150 is a NULL pointer dereference in GStreamer's RTSP support library, specifically in gst_rtsp_message_parse_auth_credentials() (part of gst-plugins-base). A specially crafted whitespace placement in a Digest Authorization or WWW-Authenticate header causes an internal length calculati...
CVE-2026-85150 Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...
EUVD-2026-70380
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...