PT-2026-107164

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An authenticated user with connector management privileges can cause a denial of service by creating connector resources with an excessively large description field. When these resource...

CVE-2026-106453: Memory Allocation with Excessive Size Value

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...

PT-2026-107239

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4 Description The readHeader function in net.jpountz.lz4.LZ4FrameInputStream allocates two 4 MiB block buffers when a maximum-block-size frame header is processed. In the default concatenated-frame mode, ...

SUSE SLES12 Security Update : rpcbind (SUSE-SU-2026:4446-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4446-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...

EUVD-2026-92624

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: The reference to the devm device for the hidinput inputdevice name needs to be corrected. Instead of referring to the input device, the correct device should be used. Referring to the inputdevice would lead to a...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, a specially crafted SVG file containing a malicious element would cause ImageMagick to attempt to allocate approximately 674 GB of memory, resulting in a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: toshibahaps: Fixed memory leaks in the add/remove routines. - toshibahapsadd leaks the haps object it allocates if an error occurs after successfully allocating that object. - toshibahapsremove does not free the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: exfat: Use kvmallocarray/kvfree instead of kmallocarray/kfree. The call stack shown below represents a scenario in the Linux 4.19 kernel. Memory allocation failed for the exfat file system, due to system memory fragmentation...

Astra Linux – Vulnerability in Harfbuzz

HarfBuzz is a text shaping engine. Prior to version 12.3.0, there was a null pointer dereference vulnerability in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check whether hbmalloc returns NULL before using placement new to construct an...

Astra Linux – Vulnerability in Firefox and Thunderbird

In ExPat before version 2.7.2, the libexpat library allowed attackers to trigger large dynamic memory allocations through a small document that was submitted for parsing...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Regulator: gpio – Fixed an issue where access to drvdata::gpiods resulted in out-of-bounds access. drvdata::gpiods is supposed to hold an array of gpiodesc pointers. However, only one pointer is allocated for this purpose. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: The issue was fixed by correcting fbsetvar to prevent a null-ptr dereference in fbvideomodetovar. If fbaddvideomode in fbsetvar fails to allocate memory for fbvideomode, it may lead to a null-ptr dereference in...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data. The driver needs to keep track of all possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256, and the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tpm: Changed to kvalloc in eventlog/acpi.c The following failure was reported on HPE ProLiant D320: 10.693310 T1 tpmtis STM0925:00: 2.0 TPM device-id 0x3, rev-id 0 10.848132 T1 ------------ Cut here ------------ 10.853559 T1...

Astra Linux - Vulnerability in libstb

stbvorbis is a single-file library licensed under the MIT License for processing Ogg Vorbis files. A specially crafted file may trigger an out-of-bounds write in f-vendorlen = char'\0';. The root cause is that if the len value read in startdecoder is -1, len + 1 becomes 0 when passed to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Added a check for a failure in memory allocation for rgbydata. In iacss3astatisticsallocate, there is no check on the allocation result of the rgbydata memory. If rgbydata is not successfully allocated, it may...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-samples to accommodate stream-nsamples + samplescount elements of type QtDemuxSample. The problem is that samplescount is read from the input file. If th...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, resulting in uncontrolled memory allocation. This can lead to a denial of service attack on the host system, causing the QEMU process to terminate...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: Use ctx-lock to protect member variables related to memory allocation/free operations. The Exynos Virtual Display driver performs memory allocation/free operations without lock protection, which can easily lead ...