MAL-2026-17464 Malicious code in voxcpmui3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9db4ea82be2cd2e2d4d7eb40236b22a9ccd0e0414cad836b98ca63468c4071e The package presents itself as a text-to-speech inference harness but contains no TTS code. On calling the exported Harness.run, the module chmods +x...

Malicious code in voxcpmui3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9db4ea82be2cd2e2d4d7eb40236b22a9ccd0e0414cad836b98ca63468c4071e The package presents itself as a text-to-speech inference harness but contains no TTS code. On calling the exported Harness.run, the module chmods +x...

ECHO-36C4-65B5-D264 Java-only: TSaslTransport has no size limit on post-auth data frames. Built with --without-java; no Java binary package is produced.

Bulletin has no description...

ECHO-CB5B-CE35-C664 Java-only: the TSaslNonblockingServer allocates a pre-auth SASL frame of any size the peer declares. Built with --without-java; no Java binary package is produced.

Bulletin has no description...

ECHO-9A41-FD88-BA7D Java-only: the remainder of CVE-2026-61373 in TSaslNonblockingServer. Built with --without-java; no Java binary package is produced.

Bulletin has no description...

ECHO-3073-2AB6-F3CE Lua-only: readMessageBegin skips checkStringSize on the pre-versioned name. Built with --without-lua; no Lua binary package is produced.

Bulletin has no description...

ECHO-0533-4861-9A91 Node.js-only: a JSON member name can stall the event loop in the nodejs TJSONProtocol. Built with --without-nodejs; no Node binary package is produced.

Bulletin has no description...

ECHO-2105-178D-17AB Node.js-only: TJSONProtocol uses a container size declared by the peer as an unbounded loop bound. Built with --without-nodejs; no Node binary package is produced.

Bulletin has no description...

ECHO-8349-28F8-24B1 Delphi-only: buffered transport reads are not counted against MaxMessageSize. lib/delphi has no autotools build and no binary package ships it.

Bulletin has no description...

ECHO-1BB9-37B4-45B7 Lua-only: TFramedTransport and THttpTransport re-slice the buffer on every read. Built with --without-lua; no Lua binary package is produced.

Bulletin has no description...

ECHO-5B20-0629-38E0 Erlang-only: thrift_json_protocol reads a whole message with no size bound. Built with --without-erlang; no Erlang binary package is produced.

Bulletin has no description...

ECHO-8D5E-E094-CE34 Lua-only: the TJsonProtocol string and number readers are unbounded and quadratic. Built with --without-lua; no Lua binary package is produced.

Bulletin has no description...

ECHO-1837-F347-D4EF Lua-only: THttpTransport:_parseHeaders uses a backtracking pattern. Built with --without-lua; no Lua binary package is produced.

Bulletin has no description...

ECHO-8388-6CB2-F86F D-only: a truncated HTTP request stops the D server. No D compiler is in Build-Depends, so lib/d is never built, and no binary package ships it.

Bulletin has no description...

ECHO-7068-A82E-7936 Dart-only: TBinaryProtocol.readMessageBegin allocates from the pre-versioned name length. No Dart SDK is in Build-Depends, and no binary package ships lib/dart.

Bulletin has no description...

ECHO-3E90-5931-8CC8 Java ME only: TJsonProtocol has no string size bound. lib/javame has no autotools hook, and no binary package ships it.

Bulletin has no description...

ECHO-75F9-4777-A649 Node.js-only: server.js ends the process on any per-connection error. Built with --without-nodejs; no Node binary package is produced.

Bulletin has no description...

ECHO-B697-02DF-DD87 Erlang-only: thrift_protocol:read/2 in lib/erl followed struct nesting without a depth limit. The upstream fix (e94803e2) is entirely in the Erlang runtime; generated Erlang code only carries struct_info type descriptors, so thrift-compiler's Erlang generator is unchanged. Built with --without-erlang; no Erlang binary package is produced.

Bulletin has no description...

ECHO-3142-9EE0-CC4E Java-only: TSaslNonblockingServer orphans a connection on a pre-auth parse error. Built with --without-java; no Java binary package is produced.

Bulletin has no description...

ECHO-F168-B048-19C7 Node.js-only: web_server.js has no error listener on an upgraded WebSocket connection. Built with --without-nodejs; no Node binary package is produced.

Bulletin has no description...