CVE-2026-98198

A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service DoS or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resultin...

CVE-2026-98193

A flaw was found in the Linux kernel's libipw wireless driver. When processing Temporal Key Integrity Protocol TKIP network frames, the driver assumes the frame contains a complete Message Integrity Check MIC without verifying that the packet meets the minimum expected length. An attacker within...

CVE-2026-98199

A flaw was found in the Linux kernel's Power Management Bus PMBus subsystem. This vulnerability allows an attacker capable of triggering the probing of affected power management devices to cause a Denial of Service DoS or memory corruption. The issue stems from certain hardware drivers supporting...

CVE-2026-98200

A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...

CVE-2026-98188

A flaw was found in the Linux kernel's p54 wireless driver. An attacker capable of connecting a malicious wireless device could cause a Denial of Service DoS by triggering a system crash. This issue occurs because the driver fails to validate data length parameters when reading calibration curve...

AZL-107475 CVE-2026-97031 affecting package golang 1.26.7-1

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

DEBIAN-CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

AZL-107487 CVE-2026-97031 affecting package golang 1.27.1-1

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

AZL-107463 CVE-2026-94440 affecting package golang 1.26.7-1

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

DEBIAN-CVE-2026-94440

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

AZL-107478 CVE-2026-94440 affecting package golang 1.27.1-1

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

CVE-2026-94440

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

AZL-108227 CVE-2026-78659 affecting package golang 1.27.1-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107544 CVE-2026-78659 affecting package jx 3.10.182-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107601 CVE-2026-78659 affecting package keda 2.14.1-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107306 CVE-2026-78659 affecting package docker-buildx 0.14.0-17

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107387 CVE-2026-78659 affecting package flannel 0.24.2-32

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107282 CVE-2026-78659 affecting package cri-tools 1.32.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107514 CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...