CVE-2026-98169

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98168

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98167

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98165

Removed by vendor...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via self-referential schema definitions

A flaw was found in kin-openapi. A remote attacker could cause a Denial of Service DoS by providing a specially crafted OpenAPI document containing self-referential schema definitions. During parsing, an uninitialized reference causes the application to terminate unexpectedly prior to document...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation

A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service DoS by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to...

undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake

A flaw was found in undici. A malicious remote server can cause a Denial of Service DoS by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream ope...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

grafana: grafana: Denial of Service via oversized Git Sync responses

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter

A flaw was found in kin-openapi's openapi3filter module. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by crashing the application. The issue occurs when processing OpenAPI 3.1 array schemas that lack an items definition, causing the parser to...

axios: Axios: Information disclosure via improper CIDR proxy bypass handling

A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing CIDR notation in proxy bypass lists as IP address ranges, treating them as plain text...

golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile

A flaw was found in golang.org/x/text. An attacker can cause a Denial of Service DoS by submitting specially crafted input to an application utilizing the Nickname profile. When transforming this input into an undersized destination buffer, an out-of-bounds slice indexing error occurs, causing th...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...