CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40017

Dovecot (per Open-Xchange advisory) is vulnerable to a hash-table collision in the IMAP THREAD command: an attacker who can send mail to a user can craft message header values that collide in an internal hash table, causing the THREAD command to consume CPU disproportionate to message size , lead...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

EUVD-2026-67666

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

UBUNTU-CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-81706

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81714

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

Impact For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped. Patches Upgrade to 2.3.1 Workarounds You c...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54713

CakePHP Queue (a queue-interop compatible queueing library) has an incomplete comparison in QueueManager::getUniqueId() that affects versions 0.1.11 through 2.3.1 . When shouldBeUnique is enabled, the method generates job identifiers from the job class, method, and parameters, but sorting paramet...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

EUVD-2026-67062

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706

openssl_encrypt before 1.4.9 is vulnerable to key substitution via identity shadowing . The root cause lies in IdentityStore , which fails to prevent namespace collisions between a user's own identities and contacts. An attacker can create shadowed contact entries that remain invisible until the ...

SUSE SLED15 / SLES15 Security Update : git-lfs (SUSE-SU-2026:3801-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3801-1 advisory. This update for git-lfs fixes the following issue: - CVE-2025-26625: certain commands may write to files visible outsid...