CVE-2026-16176

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation...

CVE-2026-16176 IBM DataPower Gateway Denial of Service

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation...

CVE-2026-16176

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to a denial of service (DoS) attack. The root cause is improper validation of the length field during memory reallocation (CWE-770). A remote ...

EUVD-2026-94891

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation...

CLEANSTART-2026-HI60053 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

CVE-2026-16728 affects multiple packages. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. See references for individual vulnerability details...

CLEANSTART-2026-SU76745 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

AlmaLinux 9 : bind (ALSA-2026:75767)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75767 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via craft...

CVE-2026-16176: Allocation of Resources Without Limits or Throttling

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation...

PT-2026-108631

Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...

PT-2026-107934

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

GHSA-4V53-57PG-C464 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap. Details In...

ROS-20261007-73-0203

The vulnerability of the netopenvswitch/flownetlink.c module in the Linux operating system is related to errors in processing parameter length settings. Exploiting this vulnerability can allow an attacker to increase their privileges...

SUSE SLES15 Security Update : kernel (Live Patch 21 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4538-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4538-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.81 fixes one security issue: The following security issue was fixed: - CVE-2026-74612:...

CVE-2026-80048

A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...

AZL-106691 CVE-2026-106585 affecting package openssh 9.8p1-10

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

CVE-2026-106585

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

CVE-2026-106585

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

CVE-2026-106585

The OpenSSH sshd and ssh components in versions before 10.6 are vulnerable to a data amplification issue. The root cause is a lack of checks to determine if the maximum packet length is exceeded when decompressing highly compressed data . This vulnerability could lead to impacts on integrity and ...

CVE-2026-106453 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...