3922 matches found
CVE-2026-68981
The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...
Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...
SUSE-SU-2026:3431-1 Security update for perl-Net-DNS
This update for perl-Net-DNS fixes the following issue - CVE-2026-64194: RFC 1035 compression pointers are followed via recursion with no depth limit established, which can lead to DoS when specially crafted DNS packets are parsed bsc1272214...
CVE-2026-59881 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...
CVE-2026-59881
AIOHTTP WebSocket client vulnerability: before 3.14.2, the client accepts and decompresses frames with RSV1 set even when permessage-deflate was not negotiated, enabling potential CPU and memory overuse by a malicious server. Affected: AIOHTTP (WebSocket client). Root cause: decompressing frames ...
kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation
A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression DSC processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a...
org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...
kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation
A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression DSC processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a...
kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation
A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression DSC processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a...
CVE-2026-64436
A flaw was found in the Linux kernel. An uninitialized variable in the IPComp IP Compression state handling could allow a local attacker to trigger an out-of-bounds read during state migration. This vulnerability could lead to the disclosure of sensitive kernel memory or cause a denial of service...
CVE-2026-65100
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...
EUVD-2026-50235
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...
CVE-2026-58152
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
EUVD-2026-50204
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
PT-2026-65729
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...
cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding
A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...
cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding
A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...
K000162114: Python urllib3 vulnerability CVE-2025-66418
Security Advisory Description urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps, leading to...
CVE-2026-59248
A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...