CVE-2026-59881 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

CVE-2026-53003

In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression PFC is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an...

lz4:round_trip_frame_uncompressed_fuzzer: Use-of-uninitialized-value in LZ4_compress_fast_extState_fastReset

Project: https://github.com/lz4/lz4.git Detailed Report: https://oss-fuzz.com/testcase?key=5810591549227008 Project: lz4 Fuzzing Engine: libFuzzer Fuzz Target: roundtripframeuncompressedfuzzer Job Type: libfuzzermsanlz4 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

lz4:round_trip_frame_uncompressed_fuzzer: Use-of-uninitialized-value in LZ4HC_compress_generic_noDictCtx

Project: https://github.com/lz4/lz4.git Detailed Report: https://oss-fuzz.com/testcase?key=6235198659887104 Project: lz4 Fuzzing Engine: libFuzzer Fuzz Target: roundtripframeuncompressedfuzzer Job Type: libfuzzermsanlz4 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

DEBIAN-CVE-2018-10893

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code...