collisions

ハッシュ衝突と悪用 作者: Ange Albertini と Marc Stevens. FAQ TL;DR Q: ファイルに任意のMD2/MD4/MD5/MD6/SHA1/SHA2/SHA3、または別のファイルと同じハッシュを付与することは可能ですか？ A: いいえ。 Q: 同じハッシュを持つ2つの異なるファイルを作成できますか？ A: MD5なら、標準的なコンピュータで数秒です。SHA1なら、可能ですが、エンドユーザーには現実的ではありません（計算量: 2^61.2 コスト: $11k）。 Q: データを追加することで、2つの異なるファイルに同じハッシュを持たせられますか？ A:...

Rocky Linux 9 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19365)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619365 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

Rocky Linux 9 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc (crlsa-2025_9430)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259430 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc (crlsa-2025_8411)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258411 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description block...

CentOS Linux 8.5 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / libkadm5 (CENTOS8.5:CLSA-2025:1751895517)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1751895517 advisory. - A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in t...

Rocky Linux 10.0 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc (crlsa-2025_9418)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259418 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description blo...

CentOS Linux 8.4 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / libkadm5 (CENTOS8.4:CLSA-2025:1751892444)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1751892444 advisory. - A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in t...

CVE-2026-86831

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod...

CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod...

Astra Linux – Vulnerability in gnupg2

A flaw was discovered in the way certificate signatures can be forged using collisions found in the SHA-1 algorithm. Attackers could exploit this weakness to create forged certificate signatures. This issue affects GnuPG versions prior to 2.2.18...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed a transaction abort during file creation due to name hash collisions. If we attempt to create several files with names that result in the same hash, we must package them in the same directory item, and there is a...

CVE-2026-71644

An issue in Robotics-STAR-Lab SYSU STAR Group RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE...

CVE-2026-71644: Access of Resource Using Incompatible Type

An issue in Robotics-STAR-Lab SYSU STAR Group RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE...

CVE-2026-9745

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 are affected by a missing bucket ownership validation when using the ExpectedBucketOwner parameter. This omission allows a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an uninte...

Incomplete Comparison with Missing Factors

Overview Affected versions of this package are vulnerable to Incomplete Comparison with Missing Factors in the getUniqueId process. An attacker can cause legitimate jobs to be dropped by supplying crafted user data that results in identifier collisions. Workaround This vulnerability can be...

GHSA-R5PM-VRC5-3M73 cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

Impact For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped. Patches Upgrade to 2.3.1 Workarounds You c...

CVE-2026-54713: Incomplete Comparison with Missing Factors

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-76216: Authorization Bypass Through User-Controlled Key

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

CVE-2026-71327

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and...