EUVD-2026-72106

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

CVE-2026-86250 h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

CVE-2022-51009

PocketMine-MP before 4.7.2 is vulnerable to a remote denial-of-service via unhandled exceptions in the adhocore/json-comment library when parsing skin geometry data. An unauthenticated attacker can send a login or skin packet containing invalid geometry JSON, triggering an unhandled RuntimeExcept...

CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...

CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...

CVE-2022-51008

PocketMine-MP versions prior to 4.12.3 are vulnerable to a denial-of-service via unauthenticated session exhaustion. The server fails to limit connections that have not yet completed authentication, so an attacker can flood it with connections that occupy max-player slots without ever sending a L...

CVE-2022-51009 PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

EUVD-2022-56035

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...

CVE-2022-51009 PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

EUVD-2022-56036

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

CVE-2021-48007 PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

EUVD-2021-34877

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from...

CVE-2021-48007

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in the MovePlayerPacket position and rotation fields. A malicious client can send crafted movement packets containing invalid floating-point values, causing unhandled mathematical operations that crash the server (denial of s...

CVE-2020-37277

PocketMine-MP versions prior to 3.15.4 are affected by a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. A malicious, authenticated client can send specially crafted InventoryTransactionPackets containing multiple conflicting pathways , causing exp...

CVE-2020-37277 PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

EUVD-2020-31270

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity,...

PT-2026-86574

Name of the Vulnerable Software and Affected Versions valkey-io valkey versions prior to 9.0.6 valkey-io valkey versions prior to 9.1.2 Description A weakness exists in the kvstoreGetHashtable function within the src/kvstore.c file. Manipulation of the didx variable can lead to an out-of-bounds...

trivy-0.74.0-3.1 on GA media (moderate)

trivy-0.74.0-3.1 on GA media Announcement ID: openSUSE-SU-2026:11691-1 Rating: moderate Cross-References: CVE-2026-56855 CVSS scores: CVE-2026-56855 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-56855 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053295)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053295 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: serialize hash resizes and cleanups Syzbot was able to trigger the followin...

Linux Distros Unpatched Vulnerability : CVE-2026-57159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the S...