OESA-2026-3067 jpegxl security update

This package contains a reference implementation of JPEG XL encoder and decoder. Security Fixes: Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.CVE-2025-70103...

jsoncons:fuzz_msgpack: Heap-buffer-overflow in jsoncons::heap::heap_string_factory<unsigned char, unsigned long, std::__1::allo

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5217334684614656 Project: jsoncons Fuzzing Engine: honggfuzz Fuzz Target: fuzzmsgpack Job Type: honggfuzzasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

MGASA-2026-0269 Updated perl-Mojolicious package fixes a security vulnerability

The updated package fixes a security vulnerability: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. CVE-2026-14803...

Updated perl-Mojolicious package fixes a security vulnerability

The updated package fixes a security vulnerability: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. CVE-2026-14803...

PT-2026-61169

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The VCN encoder and decoder rings in the drm/amdgpu/vcn component do not support 64-bit user fence writes. This issue leads to the rejection of CS submissions that utilize user fences...

PT-2026-61170

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the AMDGPU VCN 4.0 path contains an issue where VCN encoder and decoder rings do not support 64-bit user fence writes. This necessitates the rejection of CS...

Linux Distros Unpatched Vulnerability : CVE-2026-44891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final,...

terminal-poc-corpus

terminal-poc-corpus A defensive, machine-readable corpus...

CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

DEBIAN-CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

EUVD-2026-45316

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

CVE-2026-44891

CVE-2026-44891 affects Netty’s StompSubframeDecoder. Prior to 4.1.136.Final and 4.2.16.Final, StompSubframeDecoder does not cap total headers or cumulative size per frame; maxLineLength only bounds individual header lines. An attacker can submit many small headers that accumulate in DefaultStompH...

CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

...

CVE-2026-57075

A flaw was found in YAML::Syck. An out-of-bounds read vulnerability exists in the base64 decoder, specifically in the syckbase64dec function. This occurs because the decoder uses a signed character to index a lookup table, allowing specially crafted !!binary YAML nodes with high-bit bytes to caus...

EUVD-2026-45054

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte = 0x80 sign-extends to a negative index and...

The vulnerability of the `io.netty.handler.codec.http3.QpackDecoder` component in the Netty framework, which is used for developing network applications, servers, and clients. This vulnerability allows attackers to cause service interruptions.

The vulnerability of the io.netty.handler.codec.http3.QpackDecoder component in the Netty framework, which is used for developing network applications, servers, and clients, involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service...

The vulnerability of the SIXEL decoder in the console-based image editing software ImageMagick, which allows a hacker to trigger a service failure.

The vulnerability of the SIXEL decoder in the console-based image editing software ImageMagick is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause a service failure...