95819 matches found
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...
GHSA-F94X-6692-553Q music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
GHSA-JJPR-9CVF-CQ55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the path tokenizer in cairosvg/path.py, where the path function uses repeated string splitting on SVG path data, resulting in quadratic time complexity. An attacker can supply an SVG file containin...
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
GHSA-C3JG-QH8M-J3H2 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...
GHSA-M9XH-6747-9R6F svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...
GHSA-V383-3RW5-Q8RF enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...
AZL-107439 CVE-2026-95209 affecting package gnutls 3.8.13-1
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
DEBIAN-CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...
CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...