5364 matches found
RHEL 9 : libarchive (RHSA-2026:58574)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58574 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...
AZL-97308 CVE-2026-74723 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...
CVE-2026-74723 btrfs: lzo: reject inline extents without valid headers
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...
CVE-2026-77640
A flaw was found in tor. A remote attacker could send a specially crafted, truncated zlib/gzip stream. This could lead to an infinite loop during decompression, causing a denial of service DoS in the affected component. Mitigation Mitigation for this issue is either not available or the currently...
grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::TileCodingParams::readMct
Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5027344826564608 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...
MiracleLinux 9 : libarchive-3.5.3-11.el9_8 (AXSA:2026-1610:06)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1610:06 advisory. libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filteredbuf pointer in initunpack CVE-2026-14164 Tenable has extracted the...
MiracleLinux 9 : fence-agents-4.10.0-110.el9_8.5 (AXSA:2026-1605:15)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1605:15 advisory. httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies CVE-2026-59939 Tenable has extracted the preceding description bloc...
PT-2026-79728
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs module when processing inline LZO compressed file extents. When a crafted btrfs image is used, the lzo decompress function may attempt to read a segment head...
Linux Distros Unpatched Vulnerability : CVE-2026-74723
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compresse...
CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
UBUNTU-CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
EUVD-2026-64185
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524
WeeChat versions 4.3.0 through 4.9.0 contain a decompression bomb vulnerability in the relay module's WebSocket permessage-deflate decompression function (relay_websocket_inflate()). The function imposes no upper bound on output size, allowing an authenticated relay user to send a small compresse...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
grok:grk_decompress_mercury_fuzzer: Heap-buffer-overflow in bool grk::GrkImage::compositePlanar<int>
Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6270477761576960 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressmercuryfuzzer Job Type: libfuzzerasangrok...
Linux Distros Unpatched Vulnerability : CVE-2026-77640
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...