crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

grafana security update

An update is available for grafana. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

RLSA-2026:62406 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

grafana security update

An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

RLSA-2026:62571 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

RLSA-2026:62667 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: perl-DBI: perl-DBI: Hea...

CVE-2026-74835

A flaw was found in the inets application HTTP server httpd. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted chunked request that fails to enforce a configured body-size limit. This can lead to memory exhaustion, causing a Denial of Service DoS on...

CVE-2026-84887

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possibl...

CVE-2026-84885

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file codeagent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-84851

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines VMs, a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could...

kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down

A flaw was found in the Linux kernel's bonding driver, specifically within the Active-Backup Load Balancing ALB receive path. A local attacker can trigger a Use-After-Free UAF vulnerability in the rlbarprecv function by rapidly bringing a bond interface up and down while receiving Address...

kernel: nfsd: release layout stid on setlease failure

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When a setlease operation fails, the system prematurely releases a layout state identifier. An attacker could exploit this by triggering the failure, leading to a use-after-free vulnerability. This could result in a system...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

kernel: nfsd: fix posix_acl leak on SETACL decode failure

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability occurs during the processing of Access Control List ACL set operations. If a specific decode step fails, a memory leak of a posixacl object occurs. This can lead to resource exhaustion over time, potentiall...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...