CVE-2026-62250 LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decodepreR13entities in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decodepreR13 in src/decoder11.c computes size from the raw file-controlled...

CVE-2026-62250 LibreDWG: unbounded allocation in pre-R13 DWG entity decoding

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decodepreR13entities in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decodepreR13 in src/decoder11.c computes size from the raw file-controlled...

CVE-2026-62250

The LibreDWG C library (prior to version 0.14.8413 ) is vulnerable to a denial of service (DoS) via a nonterminating loop in the decode_preR13_entities() function located in src/decode.c. A crafted pre-R13 DWG file can trigger this loop because the decode_preR13 function in src/decode_r11.c fails...

Security Bulletin: IBM Controller Disclosure Management has addressed vulnerabilities

Summary There are vulnerabilities in IBM Controller Disclosure Management. IBM Controller Disclosure Management 1.0.1.0 has addressed the applicable CVEs. Please refer to the table in the Related Information section for vulnerability impact. Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION:...

Security Bulletin: IBM MQ Console is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM MQ Console has addressed multiple vulnerabilities in IBM WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in th...

BIT-PILLOW-2026-96637 Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-115721

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...

EUVD-2026-109915

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...

CVE-2026-115721

All versions of the Apache Vysper XMPP server library are affected by an unauthenticated remote denial-of-service (DoS) vulnerability. The root cause is an unbounded XML buffer in the nbxml parser ; specifically, the XMLTokenizer accumulates bytes into an auto-expanding buffer without a maximum s...

CVE-2026-115721 Apache Vysper: Unbounded allocation

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...

PT-2026-123388

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...

CVE-2026-89319

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89319 JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89319

The JweDirectDecryptorBlock.Decrypt function is vulnerable to a flaw where it reads a 64-bit plaintext length from the _thales_aad protected-header field without performing any validation. This lack of input validation leads to three distinct failure states: a truncated field causes a binary.BigE...

EUVD-2026-108652

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89319 JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89319

"JweDirectDecryptorBlock.Decrypt" read a 64-bit plaintext length from the "thalesaad" protected-header field and used it without any validation. A truncated field panics "binary.BigEndian.Uint64", an oversized value drives an unbounded allocation, and a value larger than the decrypted block panic...

CVE-2026-89319 JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

PT-2026-121817

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thales aad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics wit...

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Summary SpiderImagePlugin's seek bypasses the decompression bomb check, allowing a tiny 1KB crafted SPIDER stack file to trigger a multi-gigabyte allocation on im.load. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause Image.open runs...