CVE-2026-80212

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

AZL-98232 CVE-2026-80212 affecting package ruby for versions less than 3.3.5-9

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

SUSE CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693

openssl_encrypt before 1.4.9 is vulnerable to a denial-of-service condition caused by insufficient validation of the total field in QR JSON payloads. An attacker can supply a crafted QR image with an extremely large total value, triggering unbounded memory allocation that leads to an out-of-memor...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81687 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

EUVD-2026-67138

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

CVE-2026-80212

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

CVE-2026-80212

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

CVE-2026-80212

CVE-2026-80212 is a memory exhaustion vulnerability in the resolv gem before 0.7.2 for Ruby. The root cause is that Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create permanently register a new class for every unknown DNS resource rec...

CVE-2026-67590

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service...

CVE-2026-58060

A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service DoS condition. This issue affects Bouncy Castle f...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by multiple vulnerabilities (CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325)

Summary There are multiple vulnerabilities in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0...

EUVD-2026-66503

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...