CVE-2026-90927

filebrowser through 2.63.23 contains a denial-of-service vulnerability in the /api/command handler . The server fails to limit WebSocket message size before performing permission checks, allowing any authenticated user to buffer arbitrarily large messages and exhaust server heap memory. Notably, ...

CVE-2026-90928

File Browser through 2.63.23 contains a memory exhaustion vulnerability in its subtitle conversion endpoint . The endpoint loads entire subtitle files (.srt, .ass, .ssa) into memory without imposing size limits. An authenticated attacker with download permission can request conversion of large su...

CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with an unvalidated length at nfsreadlinkreply, located in the “if” block, after calculating the new path length...

Astra Linux – Vulnerability in node-brace-expansion

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion was vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provided a pattern containing repeated numeric brace ranges,...

Astra Linux – Vulnerability in jq

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq’s src/jvaux.c use unbounded recursion whose depth is controlled by the length of a path array provided by the caller, with no depth limit enforced. An attacker can provide a...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel before version 5.8. The lib/nlattr.c file allows attackers to cause a denial of service unbounded recursion through a nested Netlink policy with a back reference...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, in order to reduce overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array VLA on th...

Astra Linux – Vulnerability in curl

curl 7.84.0 supports “chained” HTTP compression algorithms, which means that a server response can be compressed multiple times, possibly using different algorithms. The number of allowable “links” in this “decompression chain” is unlimited, allowing a malicious server to insert virtually an...

Astra Linux – Vulnerability in golang-github-prometheus-client-golang

clientgolang is the instrumentation library for Go applications in Prometheus. The promhttp package within clientgolang provides tools for working with HTTP servers and clients. Prior to version 1.11.1 of clientgolang, HTTP servers were vulnerable to Denial of Service attacks due to unbounded...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow, because getstdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: Exploitation may be impractical due to the execution time required to cause an overflow multiple days...

Astra Linux – Vulnerability in Linux

A issue was discovered in Xen through version 4.14.x. Some operating systems, such as Linux, FreeBSD, and NetBSD, process watch events using a single thread. If these events are received faster than the thread can handle them, they will be queued up. Since the queue is unbounded, a guest system m...

Astra Linux – Vulnerability in pkgconf

In pkgconf up to 1.9.3, variable duplication can lead to unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleParse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in the GNU Binutils through version 2.31. There is a heap-based buffer overflow in the bfdelf32swapphdrin function in elfcode.h, because the number of program headers is not restricted...

Astra Linux – Vulnerability in Netty

In Netty 4.1.x before 4.1.46, the ZlibDecoders allowed unbounded memory allocation when decoding Zlib-encoded byte streams. An attacker could send a large Zlib-encoded byte stream to the Netty server, forcing the server to allocate all of its available memory to a single decoder...

Astra Linux – Vulnerability in Tomcat9

Vulnerability of resource allocation without limits or throttling in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, and from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended...

Astra Linux - Vulnerability in Golang-1.19

Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Moreover, the error string is created through repeated string concatenation, resulting in quadratic runtime. Therefore, a certificate provided by a malicious actor can...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before version 2.25.0 and before versions 2.16.9 LTS and 2.7.18 LTS. The calculations performed by mbedtlsmpiexpmod are not limited; therefore, providing overly large parameters could lead to a denial of service when generating Diffie-Hellman key pairs...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dmcrypt: added condresched to dmcryptwrite. The loop in dmcryptwrite may run for an unlimited amount of time; therefore, condresched is needed in it. This commit fixes the following warnings: 3391.153255 C12 watchdog: BUG: sof...

CVE-2026-5132

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib in Calls WebSocket messages. An authenticated attacker (low privileges) can send many SDP messages that decompress to a large size, ca...