101761 matches found
httpd: Fix of CVE-2026-63292
CVE-2026-63292: modvhostalias: stack buffer overflow when a single Host header segment exceeds HUGESTRINGLEN; reject the expansion...
CLSA-2026-1791487835 httpd: Fix of CVE-2026-63292
CVE-2026-63292: modvhostalias: stack buffer overflow when a single Host header segment exceeds HUGESTRINGLEN; reject the expansion...
CVE-2026-107837 RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, receive in sys/net/gnrc/networklayer/sixlowpan/gnrcsixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload...
RHLW-2026-90932E54C65972CD Lightwell Security Advisory: json-smart 2.5.0.rhlw-00001
Red Hat Lightwell has released net.minidev:json-smart 2.5.0.rhlw-00001 with a backported security fix. CVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’’, a stack exhaustion can be...
RHLW-2026-A4C4A4BF58E29184 Lightwell Security Advisory: json-path 2.7.0.rhlw-00001
Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.7.0.rhlw-00001 with a backported security fix. CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method. This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path...
CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...
CVE-2026-107826
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...
EUVD-2026-95925
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...
CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...
CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...
CVE-2026-107826
The OWASP Coraza WAF library (versions 3.0.0 to 3.8.1 ) is vulnerable to a stack overflow due to how the readJSON function in internal/bodyprocessors/json.go handles argument limits. When the bounded flattening walk reaches the SecArgumentsLimit or byte budget, it may still call gjson.Valid on th...
DEBIAN-CVE-2026-107815
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...
CVE-2026-107815
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...
CVE-2026-107815
A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to...
SUSE CVE-2026-107678
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...
SUSE CVE-2026-107705
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the...
CVE-2026-107815
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...
CVE-2026-104115
A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...
CVE-2026-104115 Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon
A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...
CVE-2026-104115
A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...