Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the MMS BER decoder process. An attacker can cause the service to terminate unexpectedly by supplying a crafted length value that is not properly validated, resulting in a read past the end of a heap buffer...

Security Bulletin: IBM i is Affected By Denial of Service Vulnerability in Electronic Service Agent [CVE-2026-54399]

Summary Electronic Service Agent for IBM i uses HttpCore for HTTP message handling. HttpCore is vulnerable to a denial of service by uncontrolled resource consumption when processing messages with an excessive header length CVE-2026-54399 as described in the vulnerability details section...

EUVD-2026-51338

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

EUVD-2026-51342

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-66360

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-65421

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-56758

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...

CVE-2026-65421 MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-65421

CVE-2026-65421 affects the MMS BER decoder in the MMS/IEC 61850 stack (as noted in NVD and CVE lists). The flaw is an attacker-supplied length for fixed-width BER fields (boolean/integer) that is not validated, causing a read past the end of a heap buffer. This results in termination of the MMS s...

CVE-2026-65421

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-56758 MZ Automation libiec61850 Out-of-bounds Read

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...

CVE-2026-56758

The CVE-2026-56758 issue affects the ACSE layer during MMS connection establishment. Specifically, the AARQ PDU parsing of the calling AP title can be broken if an attacker controls a length value of zero or one, causing the parser to read past the end of a heap buffer. Documented impact in the c...

CVE-2026-56758 MZ Automation libiec61850 Out-of-bounds Read

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...

CVE-2026-66360

The CVE-2026-66360 entry describes a flaw in the ISO Presentation layer where a missing length check during normal-mode negotiation allows a zero-length field in encoded presentation data to trigger a bounded heap read before MMS session establishment. A crafted TCP/102 connection can trigger thi...

CVE-2026-66360 MZ Automation libiec61850 Out-of-bounds Read

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-66360 MZ Automation libiec61850 Out-of-bounds Read

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-66360

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

DEBIAN-CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

CVE-2026-55768 GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...