PT-2026-84260

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 snmp versions 4.25.1 through 5.18.2.0 snmp versions 5.19 through 5.20.2.1 snmp versions 5.20.3 through 5.20.4...

PT-2026-89923

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc handler.erl converts the server-supplied Content-Length wi...

PT-2026-84084

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply constraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

PT-2026-84072

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26 Description A flaw in the HTTP client can cause request desynchronization for forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the...

CVE-2026-48932: Inconsistent Interpretation of HTTP Requests

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-84236

A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault MNRF, requiring a power cycle to recover...

UBUNTU-CVE-2026-82820

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...

CVE-2026-82820 FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...

USN-8706-1 zlib vulnerability

It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption...

USN-8706-1: zlib vulnerability

It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption...

SUSE-SU-2026:3883-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276667...

SUSE CVE-2026-72149

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation Currently, the Tegra GPC DMA hardware requires the transfer length to be a multiple of the max burst size configured for the channel. When a client requests a transfer where the length...

CVE-2026-80652

A flaw was found in the Linux kernel's Cryptographic Co-processor CCP driver. A local attacker could trigger a kernel crash, leading to a denial of service DoS, by providing a zero-length certificate chain buffer during a Platform Dynamic Hardware PDH export operation. This issue specifically...

CVE-2026-80595

A flaw was found in the Linux kernel. The ims-pcu driver processes response data from device buffers without verifying the actual length of the data sent by the device. This oversight can lead to out-of-bounds reads, potentially allowing an attacker to access sensitive information or cause system...

CVE-2026-80594

A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability allows a malicious device to trigger an infinite loop by providing a specially crafted descriptor with a zero-length field during the parsing of CDC union descriptors. This can lead to a Denial of Service DoS condition,...

pipewire: RAOP RTSP NULL Deref

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

PT-2026-83956

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf string new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made...

CrowdSec -- multiple vulnerabilities

The CrowdSec Team reports: GHSA-g2x2-jgfg-pg7g: HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length. GHSA-rh69-4vqj-9gj8: Unbounded request-body read in kubernetes-audit acquisition webhook...

Linux Distros Unpatched Vulnerability : CVE-2026-80652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to...

Linux Distros Unpatched Vulnerability : CVE-2026-80595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data...