bind: Resource exhaustion via malformed DNSKEY handling

A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentiall...

CVE-2025-12657

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations...

Amazon Linux 2023 : lasso, lasso-devel, perl-lasso (ALAS2023-2025-1285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1285 advisory. A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An...

ROS-20251111-05

The vulnerability in the Ruby REXML XML toolkit is related to the fact that the application does not properly control the internal resource consumption when analyzing malformed XML code containing multiple XML declarations. Exploitation of the vulnerability could allow an attacker to cause a deni...

bind: Resource exhaustion via malformed DNSKEY handling

A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentiall...

bind9.18 security update

32:9.18.29-4.2 - Fix upstream reported regression in recent CVE fix CVE-2025-8677 - Add upstream created test to this regression 32:9.18.29-4.1 - Refuse malformed DNSKEY records CVE-2025-8677 - Address various spoofing attacks CVE-2025-40778 - Prevent cache poisoning due to weak PRNG CVE-2025-407...

CVE-2025-12890

Improper handling of malformed Connection Request with the interval set to be 1 which supposed to be illegal and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it...

F5 Networks BIG-IP : BIND vulnerability (K000157317)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4 / 21.0.0.1. It is, therefore, affected by a vulnerability as referenced in the K000157317 advisory. Querying for records within a specially crafted zone containing certain malformed DNSKEY records can...

EUVD-2025-38295

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and...

CVE-2025-7700

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and...

CVE-2025-12890

Improper handling of malformed Connection Request with the interval set to be 1 which supposed to be illegal and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it...

CVE-2025-7700 Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and...

CVE-2025-7700

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and...

CVE-2025-12890 Bluetooth: peripheral: Invalid handling of malformed connection request

Improper handling of malformed Connection Request with the interval set to be 1 which supposed to be illegal and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it...

CVE-2025-12890

CVE-2025-12890 affects Zephyr-related Bluetooth peripherals. The public data describe an improper handling of a malformed Connection Request when the interval is 1 and the chM mask is 0x7CFFFFFFFF, which triggers a crash and renders the peripheral non-connectable. This vulnerability is described ...

CVE-2025-12890 Bluetooth: peripheral: Invalid handling of malformed connection request

Improper handling of malformed Connection Request with the interval set to be 1 which supposed to be illegal and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it...

CVE-2025-12890 Bluetooth: peripheral: Invalid handling of malformed connection request

Improper handling of malformed Connection Request with the interval set to be 1 which supposed to be illegal and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it...

SUSE CVE-2025-46404

A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...

SUSE CVE-2025-46705

A denial of service vulnerability exists in the gassertnotreached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability...

CVE-2025-7700: NULL Pointer Dereference

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and...