UBUNTU-CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled server, or possibly an accidental response could trigger a DoS in the client. Workaround If unable to upgrade, the Python parser is...

CVE-2026-69244

AIOHTTP vulnerability CVE-2026-69244 affects the aiohttp library prior to 3.14.3. The issue is an out-of-bounds heap read in the C-based response parser during error message construction, specifically in aiohttp/_http_parser.pyx where an llhttp error-position pointer is used to build a snippet fo...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

Summary The built-in CORS middleware hono/cors parses the attacker-controlled Access-Control-Request-Headers request header during a preflight OPTIONS request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can...

CVE-2026-67312

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

K000162738: giflib vulnerability CVE-2026-26740

Security Advisory Description Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. CVE-2026-26740 Impact There is no impact; F...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.4.1

Red Hat OpenShift Service Mesh 3.4.1 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.4....

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.6

Red Hat OpenShift Service Mesh 3.3.6 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.3....

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.8

Red Hat OpenShift Service Mesh 3.2.8 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.2....

SUSE CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

Important: Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.11

Red Hat OpenShift Service Mesh 3.1.11 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...

axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...