OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

Overview A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, t...

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoderdecodeHuffmanEncodedLiteral may execute new bytelength for a string literal before verifying that length byt...

Unity Linux 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-007099)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007099 advisory. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large...

Updated expat packages fix security vulnerabilities

Improper restriction of xml entity expansion depth in libexpat. CVE-2024-8176 This is an extension of the fix published in MGASA-2025-0109 that was determined by upstream to be incomplete. Libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small...

CVE-2025-61910

The CVE-2025-61910 issue affects NASA ION-DTN (BPv7) 4.1.3s. A malformed CBOR extension block in a BPv7 bundle can trigger uncontrolled memory allocation during parsing: the extension block’s fifth element (a byte string) is mishandled, and an unsigned blockLength is converted to a 32‑bit signed ...

EUVD-2021-15357

Malware in sbrugna...

EUVD-2022-53193

Malicious code in bioql PyPI...

CVE-2024-53028

CVE-2024-53028 is tied to memory corruption that occurs while processing frontend messages during allocation in Qualcomm chipsets. Public references describe a memory corruption condition with high impact on confidentiality, integrity, and availability; attack vector is local with low privileges ...

SUSE CVE-2022-49701

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Allocate/free queue resource only during probe/remove Currently, the sub-queues and event pool resources are allocated/freed for every CRQ connection event such as reset and LPM. This exposes the driver to a couple...