Security Bulletin:Inconsistent Enforcement of MaxNumberLength in Jackson-Core Async JSON Parser, Leading to DoS

Summary The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary...

CVE-2026-106578

A flaw was found in ImageMagick. This vulnerability can lead to a Denial of Service DoS when the software processes untrusted input. A remote attacker could submit a specially crafted image file that triggers an invalid memory free condition in the Magick Vector Graphics MVG decoder, causing the...

CVE-2026-106571

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS by issuing a specially crafted call to the GetVirtualPixels function. An integer calculation error allows data to be written beyond allocated heap memory boundaries, resulting in an unexpected process crash...

CVE-2026-93524

A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension XKB requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data...

CVE-2026-80877

A flaw was found in the Linux kernel's AFS Andrew File System module. This vulnerability occurs in the afsupdatecell function when it attempts to update a volume list vllist that is empty. Under specific conditions, the old vllist is not properly released, leading to a memory leak. A local attack...

CVE-2026-80843

A flaw was found in the Linux kernel's xfrm IPSec framework component. This vulnerability occurs when the xfrmstateconstruct function incorrectly manages memory allocations for authentication algorithms. Specifically, it can overwrite an existing allocation, leading to a memory leak. Over time,...

CVE-2026-80811

A flaw was found in the Linux kernel's iouring/cmd component. This vulnerability allows for a memory leak due to iovec arrays not being properly freed when asynchronous commands are not recycled. An attacker could potentially exploit this by triggering specific workloads, such as NVMe passthrough...

CVE-2026-80797

A flaw was found in the Near Field Communication NFC PN533 driver in the Linux kernel. When a PN533 device is removed while data fragments are still queued, the driver's cleanup process fails to properly release these fragments, resulting in a memory leak. This can lead to system instability or...

CVE-2026-80784

A flaw was found in the Linux kernel's Multipath TCP MPTCP component. A race condition exists during socket teardown and concurrent userspace Multipath TCP MPTCP general announce operations. This can allow a local attacker to trigger a memory leak by causing an allocation to occur after a list ha...

Updated tesseract packages fix security vulnerabilities

This is a security update. It fixes nine vulnerabilities in tesseract, the OCR text recognition engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file .traineddata or a crafted word-list file. Dependi...

EUVD-2026-93560

ImageSharp: CCITT fax decompression T4/Modified Huffman: unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp...

EUVD-2026-93871

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the LZ4BlockInputStream process. An attacker can cause excessive memory allocation and exhaust system resources by supplying a crafted legacy LZ4Block stream with a large compressedLen val...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the LZ4BlockInputStream process. An attacker can cause excessive memory allocation and...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive memory allocation and trigger a denial of service by supplying a crafted input with a manipulated leng...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive...

DEBIAN-CVE-2026-106578

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

CVE-2026-106578

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

CVE-2026-106578

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

EUVD-2026-94399

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...