CVE-2026-93805

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

PT-2026-98006

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cfg80211 rx assoc resp function where the status and response-IE fields of cfg80211 connect resp params are initialized from the management frame before verifying ...

PT-2026-105006

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap recv frame currently reads that PSM unconditionally after validating only the outer L2CAP...

PT-2026-97983

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth RFCOMM component where the rfcomm recv frame function casts skb-data to struct rfcomm hdr and dereferences hdr-addr and hdr-ctrl without first validating...

PT-2026-98042

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where the l2cap recv frame function reads the two-byte Protocol Service Multiplexer PSM at the start of the payload unconditionally...

CVE-2026-61634

A flaw was found in the RabbitMQ Java client library. A malicious or compromised broker can send a method frame larger than the negotiated Advanced Message Queuing Protocol AMQP framemax value. This inconsistent validation causes the client to allocate and decode a protocol-invalid frame, leading...

SUSE CVE-2026-93494

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf a buffer for bytes that is never released, leading to a...

CVE-2026-71418

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerabilit...

libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerabilit...

libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

Fast Frame Rate Estimation in Electromagnetic Side-Channel Attacks on Public Systems

Frame refresh rate estimation is a fundamental step in identifying compromising harmonic frequencies in electromagnetic side-channel attacks. Methods based on discrete linear autocorrelation DLA are robust across different scenarios and require a computational complexity of $ON\log N$ for a signa...

Linux Distros Unpatched Vulnerability : CVE-2026-91779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GNU Binutils 2.47. This affects the function bfdelfehframesectionoffset of the file bfd/elf-eh-frame.c of the component E...

RHEL 8 : libsoup (RHSA-2026:70599)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70599 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

FreeBSD : mailpit -- Multi-frame animation bypass of thumbnail pixel budget (c1980e14-b424-11f1-bd9f-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1980e14-b424-11f1-bd9f-10ffe07f9334 advisory. Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 Thumbnail generation decodes...

GHSA-8H6X-H86X-75WH SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...

CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...

SUSE CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...