CVE-2026-13070

The CVE affects MongoDB servers performing outbound TLS connections. A malformed OCSP response during the TLS handshake can cause the server to terminate abnormally, due to OCSP stapling validation enabled by default for outgoing connections. Impact is primarily availability (possible process ter...

Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option

A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound...

CVE-2026-45382

A flaw was found in libde265, an open-source implementation of the H.265 video codec. A remote attacker could exploit this by providing a malformed H.265 video stream. Processing this malformed data can lead to a heap-buffer-overflow read, which may cause a denial of service DoS by crashing the...

PT-2026-63549

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The Bzip2Decoder handler in the compression codec pipeline is susceptible to a denial-of-service attack. A malformed bzip2 stream can trigger an infinite lo...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the heifimagehandlegetimagetiling function when processing a malformed uncompressed HEIF image item that has an associated uncC property but lacks an associated ispe property. An attacker can cause a crash by...

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

CVE-2026-47709 libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC...

EUVD-2026-41606

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...

GHSA-45RX-2JWX-CXFR OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...

GHSA-C2W2-PRH8-QM98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Impact guzzlehttp/psr7 did not reject URI host components containing authority delimiters /, ?, , @, or , an embedded port such as host:8080, or IPv6 brackets that do not frame the host such as ::1 or ::1. Uri::assertValidHost rejected only control characters, so these malformed hosts were...

GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the LLB solver and llbsolver operation handling in solver/llbsolver/ops and solver/llbsolver/vertex.go. An attacker can crash the BuildKit daemon by supplying a malicious frontend or LLB definition with...

SUSE CVE-2026-64114

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

CVE-2026-63904

A flaw was found in the Linux kernel's USB Test and Measurement Class USBTMC driver. This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could explo...

CVE-2026-64097

A flaw was found in the Linux kernel's AMD display drm/amd/display component. This vulnerability is caused by improper validation of the GPIO General Purpose Input/Output pin table size. An attacker could exploit this by providing a malformed Video BIOS VBIOS that leads to reading data beyond its...

CVE-2026-63729

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...