CVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

CVE-2026-7040

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minifyutf8 function is an alias for minify...

CVE-2026-7040

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minifyutf8 function is an alias for minify...

CVE-2026-7040 Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minifyutf8 function is an alias for minify...

CVE-2026-7040

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minifyutf8 function is an alias for minify...

EUVD-2026-25833

Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minifyutf8 function is an alias for minnify...

CVE-2026-7040

CVE-2026-7040 affects Text::Minify::XS for Perl, with versions from v0.3.0 up to, but not including, v0.7.8. The vulnerability is a heap overflow/heap corruption that occurs when processing certain malformed UTF-8 characters, as the minify functions mishandled those inputs. The issue is tied to t...

Text::Minify::XS 安全漏洞

Text::Minify::XS is a text compression tool developed by Robert Rothenberg, designed to quickly remove excess whitespace from multi-line texts. Versions of Text::Minify::XS from v0.3.0 to v0.7.8 contained security vulnerabilities. These vulnerabilities were caused by a stack overflow vulnerabilit...

CVE-2025-56353

In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 2024-02-18, a memory leak occurs due to the broker's failure to validate or reject malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with arbitrarily large or invalid filter...

PT-2026-3628

Name of the Vulnerable Software and Affected Versions tinyMQTT versions prior to commit 6226ade15bd4f97be2d196352e64dd10937c1962 Description A memory leak exists because the broker does not validate or reject malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeat...

CVE-2025-12689

Mattermost is affected by CVE-2025-12689 due to improper validation of WebSocket input in the Calls plugin (github.com/mattermost/mattermost-plugin-calls), allowing a malformed UTF-8 WebSocket request to crash the Calls plugin. Affected Mattermost releases include 11.0.x <= 11.0.4, 10.12.x &lt...

CVE-2025-12689 DoS in Calls plugin via malformed UTF-8 in WebSocket request

Mattermost versions 11.0.x = 11.0.4, 10.12.x = 10.12.2, 10.11.x = 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request...

CVE-2025-12689 DoS in Calls plugin via malformed UTF-8 in WebSocket request

Mattermost versions 11.0.x = 11.0.4, 10.12.x = 10.12.2, 10.11.x = 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. A specially crafted SVG input can cause a segfault when attempting to parse a malformed UTF-8 character. Workaround Users who are unable to upgrade to the fixed version can compile the library without SVG suppo...

UBUNTU-CVE-2023-40032

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 or later when processing untruste...

CVE-2022-45540

EyouCMS = 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char...

PT-2023-14696 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS versions prior to 1.6.0 Description: A reflected-XSS issue was discovered in the article type editor component. The issue occurs when the POST value name contains a malformed UTF-8 character. Recommendations: For EyouCMS versions prio...

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

CLSA-2022-1660757175 Fixed 15 CVEs in expat

CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs - CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution - CVE-2022-25315: Fix integer overflow in storeRawNames - CVE-2022-22822: Fix integer overflow in addBinding -...

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...