CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

EUVD-2026-107230

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...

CVE-2026-90484

The MySQL client response parser in Apache bRPC is vulnerable to a NULL pointer dereference when processing a zero-payload-length response packet from a server. The root cause resides in brpc::policy::MysqlReply::ConsumePartialIOBuf, where buf.fetch(header, 5) returns nullptr because the buffer o...

CLSA-2026-1772815097 Fix of 104 CVEs

CVE-2025-38699 - scsi: bfa: Double-free fix CVE-2025-38699 CVE-2025-38697 - jfs: upper bound check of tree index in dbAllocAG CVE-2025-38697 CVE-2025-39823 - KVM: x86: use arrayindexnospec with indices that come from guest CVE-2025-39823 CVE-2025-39689 - ftrace: Also allocate and copy hash for...

CLSA-2025-1762332910 kernel: Fix of 4 CVEs

ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 - ext4: fix memory leak in ext4fillsuper - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - ALSA: usb-audio: Fix an...

RockyLinux 8 : libxml2 (RLSA-2026:80675)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80675 advisory. libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86142 Tenable has extracted the preceding description bloc...

RHEL 8 : bind9.16 (RHSA-2026:79113)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79113 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

RockyLinux 8 : bind9.16 (RLSA-2026:79113)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79113 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

PT-2026-120784

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to versio...

PT-2026-120570

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check is full package, after which the parser reads the response ty...

PT-2026-120786

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

AZL-109953 CVE-2026-87866 affecting package curl 8.11.1-11

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

CVE-2026-105960 HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency

PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length...

CVE-2026-105960

The PEAK-System PCAN Windows drivers are affected by a vulnerability involving the improper handling of length parameter inconsistency (CWE-130). The driver fails to sufficiently cap a variable-length receive-record copy to the actual caller-supplied output length, instead using a requested or qu...

EUVD-2026-105315

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-87866

A flaw in curl allows a malicious server to bypass public key pinning when the application is built with the wolfSSL backend. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the certificate—tricked by a manipulated validity length field —extracts an...

CVE-2026-87866 wolfSSL public-key pinning bypass

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

CVE-2026-80876

A flaw was found in the Linux kernel's ring-buffer component. When 8-byte alignment is enforced, the system incorrectly calculates the length of small events. This error causes these events to report a data length that is 4 bytes larger than their actual size. This discrepancy can lead to...

CVE-2026-94018

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...