24152 matches found
CVE-2026-65421
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
CVE-2026-56758
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...
CVE-2026-65421 MZ Automation libiec61850 Out-of-bounds Read
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
CVE-2026-65421
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
CVE-2026-65421
CVE-2026-65421 affects the MMS BER decoder in the MMS/IEC 61850 stack (as noted in NVD and CVE lists). The flaw is an attacker-supplied length for fixed-width BER fields (boolean/integer) that is not validated, causing a read past the end of a heap buffer. This results in termination of the MMS s...
CVE-2026-56758
The CVE-2026-56758 issue affects the ACSE layer during MMS connection establishment. Specifically, the AARQ PDU parsing of the calling AP title can be broken if an attacker controls a length value of zero or one, causing the parser to read past the end of a heap buffer. Documented impact in the c...
CVE-2026-56758 MZ Automation libiec61850 Out-of-bounds Read
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...
CVE-2026-56758 MZ Automation libiec61850 Out-of-bounds Read
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...
CVE-2026-66360 MZ Automation libiec61850 Out-of-bounds Read
The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...
CVE-2026-66360 MZ Automation libiec61850 Out-of-bounds Read
The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...
CVE-2026-66360
The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...
CVE-2026-66360
The CVE-2026-66360 entry describes a flaw in the ISO Presentation layer where a missing length check during normal-mode negotiation allows a zero-length field in encoded presentation data to trigger a bounded heap read before MMS session establishment. A crafted TCP/102 connection can trigger thi...
DEBIAN-CVE-2026-55768
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...
CVE-2026-55768
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...
CVE-2026-55768 GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...
CVE-2026-55768 GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...
CVE-2026-55768 GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...
CVE-2026-55768
GoAccess (WebSocket server) before version 1.11 is affected by a vulnerability where a 64‑bit extended frame length is truncated to a signed 32‑bit WSFrame.payloadlen before max frame size is enforced. This allows an unauthenticated remote client to trigger an extremely large allocation (~18 exab...
MGASA-2026-0309 Updated nghttp2 packages fix a security vulnerability
The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...
