CVE-2025-12818

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions...

EUVD-2025-124939

In the Linux kernel, the following vulnerability has been resolved: nvdimm: ndtest: Return -ENOMEM if devmkcalloc fails in ndtestprobe devmkcalloc may fail. ndtestprobe allocates three DMA address arrays dcrdma, labeldma, dimmdma and later unconditionally uses them in ndtestnvdimminit, which can...

CVE-2025-40144

CVE-2025-40144 relates to the Linux kernel nvdimm subsystem: ndtest may NULL-dereference under low memory if devm_kcalloc() allocations fail. The fix adds checks for three DMA address arrays (dcr_dma, label_dma, dimm_dma) and returns -ENOMEM on allocation failure, routing to a common error path. ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990772)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990772 advisory. In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the...

firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input 250 KiB can cause the parser to allocate hundreds of megabytes, leading to denial-of-service DoS through memory exhaustion...

RHEL 10 : expat (RHSA-2025:21030)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21030 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocatio...

RockyLinux 10 : expat (RLSA-2025:19403)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:19403 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 Tenable...

CVE-2025-53411

CVE-2025-53411 affects QNAP File Station 5. The issue is an unlimited/unthrottled resource allocation vulnerability that can be exploited by an attacker who has administrator privileges to disrupt access to resources, preventing other systems/applications/processes from using the same resources. ...

CVE-2025-53413 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

RLSA-2025:19403 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 For more details about the security issues, including the impact, a CVSS score,...

firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input 250 KiB can cause the parser to allocate hundreds of megabytes, leading to denial-of-service DoS through memory exhaustion...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: idpf: returning 0 size for the RSS key if it is not supported Returning -EOPNOTSUPP from the function that returns u32 results in an invalid size value due to a cast operation. Returning -EOPNOTSUPP as a size likely leads to...

AZL-78907 CVE-2025-58183 affecting package golang 1.26.5-2

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

GO-2025-4014 Unbounded allocation when parsing GNU sparse map in archive/tar

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-12194

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All API modules, Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All API modules allows Excessive Allocation. This vulnerability is associated wi...

The vulnerability of the xfrm_alloc_spi() function in the net/xfrm/xfrm_state.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the xfrmallocspi function in the net/xfrm/xfrmstate.c module of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

JLSEC-2025-173 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a...

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing...

OESA-2025-2457 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...

OESA-2025-2456 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...

OESA-2025-2458 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...