91653 matches found
GHSA-8CFX-WX3Q-MH5Q netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop in the readFieldSection process. An attacker can cause the parsing thread to enter an infinite loop by sending a specially crafted Binary HTTP input where a known-length field section ends exactly after a complete field...
GHSA-PGRF-4654-3GQ8 netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...
Incorrect Conversion between Numeric Types
Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the BinaryHttpParser process. An attacker can cause the decoder to crash and disrupt service availability by sending a specially crafted Binary HTTP payload with large variable-length intege...
CLSA-2026-1787251300 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
CLSA-2026-1787251292 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
CLSA-2026-1787251196 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
CLSA-2026-1787250980 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
CLSA-2026-1787250962 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
[SECURITY] [DSA 6454-1] sabnzbdplus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6454-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 20, 2026 https://www.debian.org/security/faq -...
CLSA-2026-1787249757 nginx: Fix of CVE-2026-49975
CVE-2026-49975: improve the maxheaders patch to preserve binary compatibility with externally-built nginx modules...
debugging-modern-glibc-heap
When the Allocator Fights Back Debugging Modern glibc Heap...
GHSA-RRWH-6JRQ-WP5V Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiv...
BLAKE3 v1.8.7
BLAKE3 BLAKE3 is a cryptographic hash function that is: Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2. Secure , unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2. Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the...
GHSA-QQFF-5854-PX68 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...
Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3. Vulnerability Details CVEID:CVE-2026-42013 DESCRIPTION: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to...