CVE-2026-111155

A flaw was found in libtimidity. The SoundFont loader fails to properly validate sample and instrument index values, leading to an out-of-bounds memory read. An attacker could exploit this vulnerability by providing a specially crafted SoundFont .sf2 audio file, causing the application to crash a...

CVE-2026-111138

A flaw was found in libnsbmp. An attacker can exploit this vulnerability by providing a specially crafted bitmap BMP image file to an application utilizing the library. Due to improper bounds checking during the decoding of compressed image data, processing the malformed image triggers an...

CVE-2026-111139

A flaw was found in libnsbmp. This vulnerability allows an attacker to cause a Denial of Service DoS by tricking an application into processing a specially crafted icon ICO file. Due to improper bounds checking when decoding mask data for an image whose bitmap width is not an expected multiple of...

CVE-2026-111147

A flaw was found in libesedb. This vulnerability allows an attacker to cause a Denial of Service DoS or access memory contents by tricking a user or application into processing a specially crafted Extensible Storage Engine ESE database file. Due to missing boundary checks on multi-value offset...

CVE-2026-111153

A flaw was found in game-music-emu. The library fails to properly validate the voice count in audio headers, leading to an out-of-bounds read vulnerability during file processing. By convincing a user or application to open a specially crafted NES Sound Format NSF music file, an attacker can cras...

CVE-2026-111131

A flaw was found in libxmp. An attacker could exploit an off-by-one stack out-of-bounds read in the P61A depacker by convincing a user or service to process a specially crafted audio module file. Successful exploitation could lead to an application crash, resulting in a Denial of Service DoS, or...

CVE-2026-111123

A flaw was found in FluidSynth. An attacker could exploit this vulnerability by tricking a user or application into loading and playing a specially crafted SoundFont SF2 audio file containing invalid modulator destination values. This flaw triggers an out-of-bounds write, resulting in memory...

CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in...

CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in...

CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in...

CVE-2026-77630

The pupnp SDK, used for UPnP device development, is vulnerable to a Denial of Service (DoS) attack in versions prior to 22.0.4 . The root cause is that the parse_hostport function in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo. This occurs when parse_uri processes attacker-suppl...

EUVD-2026-102930

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488

The pupnp SDK (versions prior to 2.0.2 ) contains an integer truncation vulnerability in the raw_to_int function located at upnp/src/genlib/net/http/httpparser.c. The root cause is that Content-Length is parsed using strtol and then cast to a 32-bit int before being stored as an unsigned int. On ...

CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-103223

A flaw was found in vertx-pg-client. A malicious, compromised, or intermediary database server can trigger a Denial of Service DoS condition by sending a message header containing an excessively large length value before authentication completes. Because the client does not properly validate the...

CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...

CVE-2026-57487

The pupnp SDK (prior to version 2.0.2 ) contains a vulnerability where chunked Transfer-Encoding in HTTP requests allows an attacker to bypass g_maxContentLength checks. The HTTP parser in upnp/src/genlib/net/http/httpparser.c fails to set the content_length correctly for chunked bodies, while pa...

CVE-2026-57487

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...

EUVD-2026-102929

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...