95967 matches found
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...
GHSA-JJPR-9CVF-CQ55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the path tokenizer in cairosvg/path.py, where the path function uses repeated string splitting on SVG path data, resulting in quadratic time complexity. An attacker can supply an SVG file containin...
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
GHSA-C3JG-QH8M-J3H2 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...
GHSA-M9XH-6747-9R6F svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Summary Resolver::processReferences collects elements with the XPath predicate use@href or @xlink:href, which is case sensitive. A element written as xlink:HrEf is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal...
GHSA-V383-3RW5-Q8RF enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...
CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
AZL-107439 CVE-2026-95209 affecting package gnutls 3.8.13-1
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
DEBIAN-CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...
CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...
CVE-2026-107387
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file ca...
DEBIAN-CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...
DEBIAN-CVE-2026-106437
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...
CVE-2026-106437
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...