K000163640: Apache Struts vulnerabilities CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, and CVE-2026-104714

Security Advisory Description CVE-2026-104711 Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject...

DEBIAN-CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-104112

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

EUVD-2026-95807

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

The Xerial snappy-java library before version 1.1.10.9 is vulnerable to an unbounded memory allocation flaw. An attacker can provide crafted bytes to the Snappy.uncompress , uncompressString , SnappyInputStream , or SnappyFramedInputStream functions, declaring a large uncompressed length within a...

CVE-2026-104112

The illumos name service cache daemon (nscd ) is vulnerable to a kernel memory exhaustion flaw due to a missing release of file descriptors . Specifically, the switcher() procedure in usr/src/cmd/nscd/nscd_frontend.c fails to close descriptors passed via a door call that are not used by the reque...

CVE-2026-104112 Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

EUVD-2026-95801

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

CVE-2026-104112 Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory

A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...

CVE-2026-107386

A flaw was found in amqp091-go. A malicious server or remote peer can cause a Denial of Service DoS by sending a crafted frame header declaring an excessively large payload size during initial connection setup. This flaw causes the client to allocate large amounts of memory before validating the...

CVE-2026-106437

A flaw was found in mongo-c-driver. An attacker who can influence the buffer length supplied by an embedding application can trigger an integer underflow by passing an undersized value to the Binary JSON BSON buffer-reservation function. This issue leads to out-of-bounds memory reads and writes...

CVE-2026-106431

A flaw was found in mongo-c-driver. An off-by-one error in the BSON bulk document writer allows an attacker to cause a Denial of Service DoS or memory corruption. By supplying documents of a specific cumulative size that align with a buffer boundary, an attacker can trigger a single-byte...

CVE-2026-106433

A flaw was found in libmongocrypt. This vulnerability allows an authenticated attacker with permissions to modify key vault documents, or a malicious server returning crafted documents, to cause process memory corruption or a Denial of Service DoS by crashing the application. The issue occurs...