netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

AZL-106410 CVE-2026-98185 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

PT-2026-106514

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex ret 802 11 scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or...

Linux Distros Unpatched Vulnerability : CVE-2026-98185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size withou...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

lldp

lldp Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB LLDP. C2 data is carried inside Organizationally Specific TLVs Type 127 with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire. LLDP is Layer 2 only. Both agents must share a broadcast...

CVE-2026-90361

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. During the ath11kservicereadyextevent processing, a memory allocation for svcrdyext.macphycaps is not released if an error occurs during TLV Type-Length-Value parsing. This can lead to a memory leak, potentially causing resource exhausti...

AlmaLinux 9.2 [TuxCare] Security Update: wpa_supplicant (ALMALINUX9.2:CLSA-2025:1753802388)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753802388 advisory. - The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be...

CVE-2026-102758

The NetX Secure library contains a vulnerability in the _nx_secure_x509_asn1_tlv_block_parse() function, which handles ASN.1 TLV blocks during X.509 certificate parsing. The root cause is an out-of-bounds read because the function reads a one-byte ASN.1 tag from the buffer before verifying that t...

PT-2026-102770

Name of the Vulnerable Software and Affected Versions NetX Secure affected versions not specified Description An issue exists in the nx secure x509 asn1 tlv block parse function, which is used to parse ASN.1 TLV tag-length-value blocks from DER-encoded data during X.509 certificate parsing in TLS...

DEBIAN-CVE-2026-98111

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98111

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

PT-2026-98773

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel parse version tlv function fails to ensure that the value length is sufficient for the specific Type-Length-Value TLV type...

CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...