CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Summary A high-performance, lightweight AMQP 1.0 message router, written in C and built on Qpid Proton. It provides flexible and scalable interconnect between any AMQP endpoints, whether they be clients, brokers or other AMQP-enabled services. Description Apache Qpid Dispatch suffers from a...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Apache Qpid Dispatch Router version 1.19.0 contains an unbounded recursion denial-of-service vulnerability in its AMQP field parser. A mutually authenticated remote peer can supply deeply nested message annotations to exhaust the stack and crash the router. / Apache Qpid Dispatch Router 1.19.0...

unarr -- multiple vulnerabilities in the rar, zip and tar readers

The unarr project reports: rar: Fix OOB read in rarconvunicodetoutf8 rar: Prevent heap overflow when copying filters into RAR VM zip: Fix off-by-3 heap out-of-bounds read in ZIP64 extra field parser tar: Fix off-by-1 heap overflow in targetname when concatenating USTAR filename and prefix at full...

skupper-router: skupper-router: Unbounded recursion in AMQP field parser leads to denial of service

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

WS-2026-0080

The OpenBao SDK github.com/openbao/openbao/sdk/v2 before v2.6.3 / v2.7.1: the framework field parser getPrimitive for TypeKVPair and TypeHeader fields copied the raw invalid submitted value into its error message. Because error messages reach the audit log without HMAC redaction, sensitive values...

CVE-2026-82333

A flaw was found in Multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a specially crafted multipart request containing oversized array indices in field names. This can cause Multer's field parser to synchronously iterate a maximum-length sparse array, which...

CVE-2026-88763

A flaw in the skupper-router component of Red Hat Service Interconnect allows denial of service via unbounded recursion in the AMQP field parser . When the router processes a specially crafted network message, the lack of recursion bounds can exhaust stack memory, causing a crash and disrupting t...

CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

PT-2026-89298

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763: Uncontrolled Recursion

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

DEBIAN-CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

CVE-2026-82333: Uncontrolled Resource Consumption

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

PT-2026-83367

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially...

CVE-2026-48102

7-Zip (versions 9.11–26.00) contains a heap out-of-bounds read in the UDF disc image handler (File Identifier Descriptor parser). In CFileId::Parse, after validating size and advancing to 38 + impLen + idLen, an alignment-padding loop reads up to 3 bytes past the end when (38 + impLen + idLen) % ...

Apache Commons Compress extra field parser denial of service vulnerability

Apache Commons Compress is a library from the Apache Software Foundation for processing compressed files. extra field parser is one of the field parsers. A security vulnerability exists in the extra field parser in Apache Commons Compress versions 1.11 through 1.15. An attacker can exploit this...