CVE-2026-94018

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-94018

The NetX Duo Web HTTP server is vulnerable to a memory safety issue where it dereferences and releases an uninitialized pointer . This occurs when the server detects a Content-Length underflow while processing a PUT request. An unauthenticated remote client can trigger this condition by sending a...

CVE-2026-94018 NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

EUVD-2026-105132

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46136)

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buflen is used to limit the iterations for retrieving the country power setting and may underflow under certain conditions due to changes in the power table in...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fixed an issue where the data length of the skb structure was underflowed. A BUGON will be triggered in include/linux/skbuff.h, resulting in intermittent kernel panics when a length underflow is detected. This issu...

CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-75085

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c is vulnerable to an out-of-bounds read due to a length underflow. The driver calculates packet length by subtracting IEEE802154_FCS_LENGTH from the radio-reported length without first verifying that the reported length ...

CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-19673

The Zephyr RTOS Ethernet L2 layer contains an out-of-bounds read and net_buf length underflow in subsys/net/l2/ethernet/ethernet.c. When parsing a truncated VLAN header (ethertype 0x8100), the ethernet_recv() function fails to re-verify the buffer length when reinterpreting the header as an 18-by...

CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

DEBIAN-CVE-2026-106437

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106437 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-104037

A vulnerability exists in SSSD where a local attacker can trigger a denial of service (DoS) . By sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket , the attacker can cause an integer underflow and an out-of-bounds memory read . This flaw leads t...

CVE-2026-104037 Sssd: sssd: denial of service via packet length underflow in autofs responder

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...

CentOS 9 : kernel-5.14.0-756.el9

"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-756.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritanc...

SUSE CVE-2026-93789

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

DEBIAN-CVE-2026-93789

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...