SUSE CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-82752: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the...

GHSA-8737-QX52-HJFF vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

CVE-2026-55512

nebula-mesh (self-hosted control plane for Slack Nebula mesh VPN) versions 0.2.0 through before 0.5.0 are vulnerable to uncontrolled resource consumption via the GET /ui/oidc/login endpoint. When OIDC is enabled, this route is registered outside the Web UI rate-limited auth group, so every unauth...

CVE-2026-55512 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...

CVE-2026-55512 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...

CVE-2026-55512 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890

undici , the Node.js HTTP client, is vulnerable to a denial of service via unbounded decompression of compressed responses. The decompress interceptor processes response bodies based on the untrusted Content-Encoding header. Although the number of encoding layers is capped, the total decompressed...

CVE-2026-80869

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

AZL-99546 CVE-2026-80836 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80783

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...

AZL-99492 CVE-2026-80783 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...

EUVD-2026-71286

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80836 crypto: virtio - bound the akcipher result length

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...