CVE-2026-62370

KubeEdge is vulnerable to an unbounded memory allocation in the pkg/viaduct/pkg/packer component. The Reader.Read function trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates memory before validating an upper bound. An authenticat...

CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...

CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...

CVE-2026-59168

The Dasel command-line tool and library (versions 3.0.0 through 3.11.0 ) are vulnerable to an unrecoverable Denial of Service (DoS) due to unbounded recursion in the JSON and XML readers. The decodeValue, decodeObject, and decodeArray functions in parsing/json/json_reader.go, along with parseElem...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59282

A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service DoS attack. A remote attacker could exploit this by providing specially crafted input, leading to...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

apache-qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-Dotnet. A remote, unauthenticated attacker could exploit this vulnerability by leveraging unbounded symbol value caching, which can lead to resource exhaustion. This can cause a denial of service DoS, making the affected system unavailable to legitimate user...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service...

Apache Qpid Proton-Dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-Dotnet. This vulnerability allows a remote attacker, without needing to authenticate, to exploit a weakness in how the software handles data structures with excessive nesting. This can lead to a StackOverflowError, which ultimately results in a denial of...

qpid-protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

CVE-2026-47321 Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:69232)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69232 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

CVE-2026-92382

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

UBUNTU-CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...