collisions

Colisiones de hash y explotaciones Por Ange Albertini y Marc Stevens. FAQ TL;DR P: ¿Es posible hacer que un archivo obtenga un MD2/MD4/MD5/MD6/SHA1/SHA2/SHA3 arbitrario, o el mismo hash que otro archivo? R: No. P: ¿Se pueden crear 2 archivos diferentes con el mismo hash? R: Con MD5, en unos...

Rocky Linux 10.2 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19151)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619151 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON...

Rocky Linux 9 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19365)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619365 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

Rocky Linux 8 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_16252)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202616252 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

Rocky Linux 9 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_16693)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202616693 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON object...

CLEANSTART-2026-UC30604 flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable

Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed a transaction abort during file creation due to name hash collisions. If we attempt to create several files with names that result in the same hash, we must package them in the same directory item, and there is a...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

EUVD-2026-52803

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

Denial Of Service (DoS)

Immutable.js is vulnerable to Denial Of Service DoS. The vulnerability is due to linear scanning of hash collision buckets in Immutable.Map and Immutable.Set, which allows an attacker to supply many colliding keys and cause excessive CPU consumption during insertion and lookup operations...

Plone <= 4.1.3 DoS

The version of Plone installed on the remote host is less than or equal to 4.1.3. It is, therefore, affected by a denial of service vulnerability due to improper handling of hash values for form parameters to prevent hash collisions. An unauthenticated, remote attacker can exploit this issue, via...

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

Linux Distros Unpatched Vulnerability : CVE-2026-59880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit...

Oracle Linux 10 : jq (ELSA-2026-19151)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19151 advisory. - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions Tenable has extracted the preceding description block direct...

SUSE-SU-2026:2983-1 Security update for jq

This update for jq fixes the following issues: - CVE-2026-32316: integer overflow within the jvpstringappend and jvpstringcopyreplacebad functions can lead to heap buffer overflow when evaluating untrusted jq queries bsc1262044. - CVE-2026-33947: unbounded recursion in functions jvsetpath,...

kas checks out SHA-like git branches as valid commits

ImpactWhen relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...