CVE-2026-92484 cxl/region: Fix use-after-free in find_pos_and_ways() error path

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...

EUVD-2026-82105

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...

GHSA-9RM7-3QHH-H2MC Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decodeByteArray and ProtoAdapter.decodeByteString use the ProtoReader32 fas...

CVE-2026-92484: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix use-after-free in findposandways error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

SUSE CVE-2026-89090

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89882: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...

SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:4150-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4150-1 advisory. - CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

GHSA-JRPM-956J-96JG Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69210

Http4s , a Scala HTTP service library, is vulnerable to a denial of service via its WebSocket decoder. In versions prior to 0.23.35 and 1.0.0-M47 , FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but incorrectly permits negative 64-bit lengths . A remote client...

CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69216

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...