CVE-2026-63276 Stack buffer overflow in CFF to Type 1 font conversion

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

CVE-2026-63276 Stack buffer overflow in CFF to Type 1 font conversion

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

ROS-20260922-73-0124

The vulnerability in golang-x-crypto is related to incorrect type conversion. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

SUSE CVE-2026-94282

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

ROS-20260921-73-0080

The vulnerability is related to errors in implicit type conversions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by sending a specially crafted LLDT LTV packet...

CVE-2026-59187

A flaw was found in OpenEXR. The exrmetrics tool is vulnerable to a heap out-of-bounds write when processing a specially crafted deep scanline EXR image. This occurs during pixel conversion operations, where the tool attempts to write floating-point data into buffers allocated for half-float data...

DEBIAN-CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

UBUNTU-CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

SUSE CVE-2026-90114

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3785)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

CVE-2026-93569: Inconsistent Interpretation of HTTP Requests

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

PT-2026-95480

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.19.6 Description An integer overflow occurs in the Op RGB24 32 to YCbCr::convert colorspace function when processing extremely large RGB images created via heif image create and heif image add plane. This overflow...

PT-2026-95422

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritize...

CVE-2026-93019: Unsigned to Signed Conversion Error

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...

PT-2026-95421

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists where the HTTP-object conversion path incorrectly processes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests as regular HTTP/1.1 CONNECT requests. This misinterpretati...

CVE-2026-84449: Integer Overflow or Wraparound

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.11), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.11) potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.4.11)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.4.11 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.11 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...