json-sanitizer

json-sanitizer Étant donné un contenu de type JSON, le JSON Sanitizer le convertit en JSON valide. Pour commencer - Contact Cet outil peut être attaché à chaque extrémité d'un pipeline de données pour aider à satisfaire le principe de Postel : soyez conservateur dans ce que vous faites, soyez...

day01-sessionreaper-lab

День 1 — Уязвимая лаборатория в стиле SessionReaper Образовательная Это крошечная лаборатория, которая моделирует основную идею, описанную для CVE-2025-54236 “SessionReaper”: неправильная проверка вложенного JSON, приводящая к опасным путям кода. Это не Magento/Adobe Commerce; это минимальная...

json-sanitizer

json-sanitizer Étant donné un contenu de type JSON, le JSON Sanitizer le convertit en JSON valide. Pour commencer - Contact Il peut être branché à l'une ou l'autre extrémité d'un pipeline de données pour aider à satisfaire le principe de Postel : soyez conservateur dans ce que vous faites, soyez...

EUVD-2023-60623

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

Oracle Linux 8 : ELSA-2026-61257-0: / iperf3 (ELSA-2026-612570)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-612570 advisory. 3.5-12.1 - Resolves: RHEL-236174 - Add JSON value checks for getparameters CVE-2026-71217 Tenable has extracted the preceding description block directly from...

Oracle Linux 9 : ELSA-2026-61389-0: / iperf3 (ELSA-2026-613890)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-613890 advisory. 3.9-17.1 - Resolves: RHEL-236176 - Add JSON value checks for getparameters CVE-2026-71217 Tenable has extracted the preceding description block directly from...

iperf3 security update

3.9-17.1 - Resolves: RHEL-236176 - Add JSON value checks for getparameters CVE-2026-71217...

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

PYSEC-2026-3755

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

CVE-2026-47110

Tiptap for PHP before version 2.1.1 contains an input validation vulnerability: if attrs.href is submitted as an array in Tiptap JSON, Link::isAllowedUri() can trigger an unhandled TypeError during preg_match(), crashing the server-side HTML rendering pipeline for all subsequent viewers of that r...

CVE-2026-10825

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot...

EUVD-2026-37043

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot...

CVE-2026-10825 Improper JSON Input Validation in WebSocket API Leads to Denial of Service

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot...

CVE-2026-10825 Improper JSON Input Validation in WebSocket API Leads to Denial of Service

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot...

CVE-2026-10825

Technical details such as affected products, specific versions, root-cause, and exploit information are not publicly provided in the supplied documents; monitor for updates.

PT-2026-49632

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot...

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions,...

CVE-2026-1092

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads...

UBUNTU-CVE-2026-33948

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen to determine buffer length instead of the actual byte...

CVE-2026-33948

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen to determine buffer length instead of the actual byte...