411 matches found
curl: CVE-2026-8458: wrong reuse for different services
Summary: I found an incomplete-fix variant of CVE-2026-5545 in curl/libcurl 8.20.0. libcurl 8.20.0 still wrongly reuses an HTTP Negotiate-authenticated connection for a later request to the same host even when the requested service principal changes via CURLOPTSERVICENAME / --service-name. In my...
Linux Distros Unpatched Vulnerability : CVE-2026-31610
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input...
CVE-2026-31610
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbddecodenegTokenInit reaches the mechToken 2 OCTET STRING...
CVE-2026-31610
CVE-2026-31610 affects ksmbd in the Linux kernel. The issue is a memory-leak in the SPNEGO decode path: during ksmbd_decode_negTokenInit, the code allocates conn->mechToken and may fail parsing later elements, leaving the previously allocated token. If the continuation path marks use_spnego fa...
EUVD-2026-25503
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbddecodenegTokenInit reaches the mechToken 2 OCTET STRING...
PT-2026-34962
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the ksmbd component during the SPNEGO decoding process. When the ksmbd decode negTokenInit function processes the mechToken OCTET STRING element, the ksmbd neg...
MiracleLinux 7 : bind-9.11.4-26.P2.4.0.1.el7.AXS7 (AXSA:2021-1548:04)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1548:04 advisory. bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation CVE-2020-8625 Tenable has extracted the preceding description...
EUVD-2015-2785
Malware in sbrugna...
EUVD-2005-0148
Malware in sbrugna...
EUVD-2014-4270
Malware in sbrugna...
EUVD-2010-0659
Malware in sbrugna...
EUVD-2014-4271
Malware in sbrugna...
EUVD-2021-0868
Malware in sbrugna...
EUVD-2004-0505
Malware in sbrugna...
EUVD-2009-2084
Malware in sbrugna...
EUVD-2019-0402
Malware in sbrugna...
curl: OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
Summary: In curl’s OpenSSL backend, osslgetchannelbinding retains a new reference to the server’s X509 certificate via SSLget1peercertificate and never releases it. When Negotiate SPNEGO over TLS is in use, this path is invoked and leaks one X509 object per trigger. Over many requests in a...
EUVD-2021-8675
Malicious code in bioql PyPI...