CVE-2026-21438 webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their...

CVE-2026-21438

CVE-2026-21438 affects the webtransport-go implementation of WebTransport prior to 0.10.0. The issue arises when repeatedly creating and closing multiple WebTransport streams; closed streams are not removed from the internal session map, preventing garbage collection of their resources and leadin...

webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

Summary An attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. Details webtransport-go maintains an internal map tracking...

PT-2026-7870

Name of the Vulnerable Software and Affected Versions webtransport-go versions prior to 0.10.0 Description An attacker can cause unbounded memory consumption by repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Chrome

Affected Software: Google Chrome prior to version 121.0.6167.8...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

Astra Linux – Vulnerability in Zabbix

In the src/libs/zbxembed/browser.c file, the esbrowserctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is then used by the browserpusherror method in the src/libs/zbxembed/browsererror.c file. A use-after-free bug can occur at this stage if the wd-browser...

Advisory ROSA-SA-2026-3121

software: binutils 2.38 WASP: ROSA-CHROME unaffected versions = binutils-2.38-7 affected versions binutils-2.38-7 CVE-ID: CVE-2025-5244 BDU-ID: 2025-10924 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the elfgcsweep function of the ld component of the GNU Binutils software development tool is...

MiracleLinux 9 : thunderbird-102.5.0-2.el9.ML.1 (AXSA:2023-5045:06)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5045:06 advisory. Mozilla: Service Workers might have learned size of cross-origin media files CVE-2022-45403 Mozilla: Fullscreen notification bypass CVE-2022-45404...

MiracleLinux 8 : thunderbird-115.14.0-1.el8_10.ML.1 (AXSA:2024-8693:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8693:19 advisory. Thunderbird: 115.14/128.1 mozilla: Fullscreen notification dialog can be obscured by document content CVE-2024-7518 mozilla: Out of bounds memory...

MiracleLinux 9 : firefox-115.4.0-1.el9.ML.1 (AXSA:2023-6565:41)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6565:41 advisory. Mozilla: Queued up rendering could have allowed websites to clickjack CVE-2023-5721 Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR...

MiracleLinux 8 : java-17-openjdk-17.0.7.0.7-1.el8 (AXSA:2023-5307:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5307:05 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK:...

MiracleLinux 8 : java-1.8.0-openjdk-1.8.0.372.b07-1.el8 (AXSA:2023-5313:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5313:07 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK:...

MiracleLinux 7 : kernel-3.10.0-229.7.2.el7 (AXSA:2015-216:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-216:01 advisory. The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the operating...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000859)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000859 advisory. The assocarraygc function in the associative-array implementation in lib/assocarray.c in the Linux kernel before 3.16.3 does not properly implement garbage collectio...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002061)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002061 advisory. The assocarraygc function in the associative-array implementation in lib/assocarray.c in the Linux kernel before 3.16.3 does not properly implement garbage collectio...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001902 advisory. Race condition in the keygcunusedkeys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service memory...