SUSE CVE-2026-72330

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

openSUSE 16: bugwarden / bugwarden-bash-completion / bugwarden-fish-completion / etc (openSUSE-SU-2026:21613-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21613-1 advisory. Changes in bugwarden: - Update to 0.5.0: Let the environment set allowed hosts and the auth header Require a bearer token on the HTTP transport Export...

OPENSUSE-SU-2026:21613-1 Security update for bugwarden

This update for bugwarden fixes the following issues: Changes in bugwarden: - Update to 0.5.0: Let the environment set allowed hosts and the auth header Require a bearer token on the HTTP transport Export audit records and diagnostics to an OTLP collector Handle SIGTERM so container stop is...

PT-2026-83612

This update for bugwarden fixes the following issues: Changes in bugwarden: - Update to 0.5.0: Let the environment set allowed hosts and the auth header Require a bearer token on the HTTP transport Export audit records and diagnostics to an OTLP collector Handle SIGTERM so container stop is...

h2 unbounded empty DATA frames

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patched in v0.4.16...

CVE-2026-50032

CVE-2026-50032: A NULL pointer dereference in the MMS Write Named Variable List handler of libIEC61850 (MMS write service) can crash the server when an empty listOfData is sent. Affected in libIEC61850 up to v1.6.1; fix status: patched in v1.6.2 (bd338f23). The issue is a DoS condition exploitabl...

GHSA-FFX7-75GC-JG7C File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely

!NOTE This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new...

Linux Distros Unpatched Vulnerability : CVE-2023-6245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is record ; empty an...

CBL Mariner 2.0 Security Update: hvloader (CVE-2023-2975)

The version of hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2975 advisory. - Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated...

SUSE CVE-2023-52700

In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel warning when sending SYN message When sending a SYN message, this kernel stack trace is observed: ... 13.396352 RIP: 0010:copyfromiter+0xb4/0x550 ... 13.398494 Call Trace: 13.398630 13.398630 ? allocskb+0xed/0x1a...

openssl: AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries

A vulnerability was found in OpenSSL. The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can...

Candid infinite decoding loop through specially crafted payload

Impact The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The proble...

CVE-2023-6245

The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is record ; empty and the canister interface expects record then the Rust candid decoder treats empty as an extra field required by the type. The problem wit...

Infinite decoding loop through specially crafted payload

The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The problem with...

CVE-2023-6245: Loop with Unreachable Exit Condition

The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is record ; empty and the canister interface expects record then the Rust candid decoder treats empty as an extra field required by the type. The problem wit...

PT-2023-32574 · Dfx +1 · Dfx +1

Name of the Vulnerable Software and Affected Versions: Candid versions 0.9.0 through 0.9.9 dfx versions 0.14.4 through 0.15.2-beta.0 Description: The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ;...

USN-6450-1 openssl vulnerabilities

Tony Battersby discovered that OpenSSL incorrectly handled key and initialization vector IV lengths. This could lead to truncation issues and result in loss of confidentiality for some symmetric cipher modes. CVE-2023-5363 Juerg Wullschleger discovered that OpenSSL incorrectly handled the AES-SIV...

OpenSSL Information Disclosure Vulnerability (20230714) - Windows

OpenSSL is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

ALPINE-CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...