collisions

Hash collisions and exploitations By Ange Albertini and Marc Stevens. FAQ TL;DR Q: Is it possible to make a file get an arbitrary MD2/MD4/MD5/MD6/SHA1/SHA2/SHA3, or the same hash as another file? A: No. Q: Can one create 2 different files with the same hash? A: With MD5, in a few seconds on a...

CVE-2026-114054

A flaw was found in vLLM. An authenticated remote attacker can cause shared cache key collisions by providing caller-controlled parameters, such as image metadata identifiers or cache salts. Successful exploitation allows requests to incorrectly reuse cached data from other operations, leading to...

CVE-2026-61844

The web-based file manager FileRise is vulnerable to a metadata filename collision before version 3.18.0 . The system flattens logical folder paths into filenames by replacing separators and spaces with hyphens, allowing distinct paths (e.g., team/docs and team-docs) to share the same metadata fi...

CVE-2026-67416 RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 servermode parser in deps/amqp10common/src/amqp10binaryparser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their...

CVE-2026-67416 RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 servermode parser in deps/amqp10common/src/amqp10binaryparser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their...

CVE-2026-67416

RabbitMQ versions 4.0.0 to 4.0.24 , 4.1.15 , 4.2.10 , and 4.3.4 are vulnerable to a prefix collision in the optimized AMQP 1.0 server_mode parser located in deps/amqp10_common/src/amqp10_binary_parser.erl. The parser fails to verify encoded symbol lengths, allowing an authenticated AMQP 1.0 publi...

CVE-2026-65104

The NVIDIA Megatron-LM framework for all platforms contains a vulnerability within its inference component. The root cause is the use of weak hashes (CWE-328), which allows an attacker to trigger hash collisions in the cache used for inference requests. Exploitation of this flaw could result in d...

CVE-2026-65104

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure...

CVE-2026-65104: Use of Weak Hash

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure...

CVE-2026-98339

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This flaw allows a nearby attacker operating a rogue wireless access point to cause a Denial of Service DoS. When an access point changes channels, stale Basic Service Set BSS network entries may fail to be removed if unexpected...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

Astra Linux – Vulnerability in gnupg2

A flaw was discovered in the way certificate signatures can be forged using collisions found in the SHA-1 algorithm. Attackers could exploit this weakness to create forged certificate signatures. This issue affects GnuPG versions prior to 2.2.18...

Rocky Linux 9 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_16693)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202616693 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

Rocky Linux 8 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_16252)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202616252 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc (crlsa-2025_8411)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258411 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2021_3492)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213492 advisory. cyrus-imapd: Denial of service via string hashing algorithm collisions CVE-2021-33582 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 10.2 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19151)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619151 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON...

Rocky Linux 9 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc (crlsa-2025_9430)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259430 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description block...

Rocky Linux 10.0 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc (crlsa-2025_9418)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259418 advisory. krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions CVE-2025-3576 Tenable has extracted the preceding description blo...

CentOS Linux 8.5 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / libkadm5 (CENTOS8.5:CLSA-2025:1751895517)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1751895517 advisory. - A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in t...