CVE-2026-47178

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

CVE-2026-45383

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in "decodercontext::decodesliceunitWPP" in "libde265/decctx.cc". When decoding a WPP Wavefront Parallel Processing HEVC slice, "ctbAddrRS" is computed...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5898 more potentially affected by CVE-2026-55833 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-55833 Source advisory: SNYK:JAVA-IONETTY-18170202...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +42446 more potentially affected by CVE-2026-55833 via io.netty:netty-codec-http (>=4.1.0.final, <=4.1.135.final)

io.netty:netty-codec-http MAVEN version =4.1.0.final, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the SpdyFrameCodec pipeline. An...

libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows setting a spatiallayerid exceeding the configured number of layers. This causes an out-of-bounds heap rea...

Security Bulletin: Vulnerability in netty-codec-http affects IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in netty-codec-http affects IBM Storage Virtualize products and could cause an integrity impact. CVE-2025-67735. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final...

CVE-2026-9499

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

CVE-2026-9499

CVE-2026-9499 describes an out-of-bounds read in QTextCodec::codecForName() within Qt’s code paths. If a non-NUL-terminated QByteArray (e.g., fromRawData()) is used, the codec-name matching may read past the buffer end. In most cases this yields an incorrect text codec; in the worst case, over-re...

CVE-2026-9499 Out-of-bounds read in QTextCodec::codecForName() in Qt

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

CVE-2026-9499 Out-of-bounds read in QTextCodec::codecForName() in Qt

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

CVE-2026-9499

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

EUVD-2026-46257

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...

CVE-2026-45382: Out-of-bounds Read

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...

CVE-2026-55851: Uncontrolled Resource Consumption

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

PT-2026-61941

Name of the Vulnerable Software and Affected Versions Qt versions 4.x Qt versions 5.x Qt versions 6.0.0 and later Description An out-of-bounds read occurs in the codecForName function of QTextCodec. This happens when the function is called with a QByteArray that is not NUL-terminated, such as tho...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +42446 more potentially affected by CVE-2026-55833 via io.netty:netty-codec-http (>=4.1.0.final, <=4.1.135.final)

io.netty:netty-codec-http MAVEN version =4.1.0.final, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5898 more potentially affected by CVE-2026-55833 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-55833 Source advisory: MEND:CVE-2026-55833...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +42446 more potentially affected by CVE-2026-55831 via io.netty:netty-codec-http (>=4.1.0.final, <=4.1.135.final)

io.netty:netty-codec-http MAVEN version =4.1.0.final, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5898 more potentially affected by CVE-2026-55831 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-55831 Source advisory: MEND:CVE-2026-55831...