4985 matches found
CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...
CVE-2026-16512
CVE-2026-16512 is an out-of-bounds read in the Zephyr RTOS gPTP (generalized Precision Time Protocol) receive path. In gptp_handle_msg() (subsys/net/l2/ethernet/gptp/gptp.c), the gPTP header is dereferenced without verifying the frame carries at least 34 bytes of payload. The GPTP_VALID_LEN() che...
CVE-2026-16512 Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...
CVE-2026-93488
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
UBUNTU-CVE-2026-93488
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
EUVD-2026-82887
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
Memory Exhaustion
com.rabbitmq, amqp-client is vulnerable to a memory exhaustion. The vulnerability is due to the client disabling the configured limit when the negotiated frameMax value is zero, which allows an attacker controlling a malicious AMQP server or performing a man-in-the-middle attack to inject oversiz...
PT-2026-95408
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists in the gptp handle msg function within subsys/net/l2/ethernet/gptp/gptp.c where the gPTP header returned by GPTP HDR is dereferenced and switched o...
CVE-2026-90378 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...
CVE-2026-90083 net/sched: act_ife: Only operate on Ethernet frames
In the Linux kernel, the following vulnerability has been resolved: net/sched: actife: Only operate on Ethernet frames actife encapsulates/decapsulates the original Ethernet header and uses skb-dev-hardheaderlen as the length of that header. That is only correct for Ethernet devices: on a device...
CVE-2026-25275
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
EUVD-2026-81325
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
CVE-2026-25275 Buffer Over-read in WLAN Firmware
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
CVE-2026-25275 Buffer Over-read in WLAN Firmware
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
CVE-2026-25275: Buffer Over-read
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
Oracle Linux 9 : libsoup (ELSA-2026-68234)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68234 advisory. - Fix CVE-2026-15711: Reject oversized WebSocket control frames Tenable has extracted the preceding description block directly from the Oracle Linux...
CVE-2026-20295
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resource...
CVE-2026-75516
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...
CVE-2026-89780
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...
