CVE-2026-98238

A flaw was found in the Linux kernel's t7xx Wireless Wide Area Network WWAN driver. This vulnerability allows an attacker to cause a Denial of Service DoS by sending malformed network packets. The driver fails to validate the network interface index in incoming packet headers before indexing an...

CVE-2026-107726

A flaw was found in Hazelcast. Improper validation of client-supplied data allows a connected client to corrupt memory, potentially leading to arbitrary code execution on cluster members. Additionally, an attacker can exploit this vulnerability to read sensitive memory contents from cluster nodes...

BIT-THRIFT-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94652 Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-93926 Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-85494 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

BIT-THRIFT-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

BIT-THRIFT-2026-82458 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

BIT-APISIX-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

CVE-2026-108039

The Apache CXF framework contains a vulnerability where StaxUtils fails to enforce limits on the total number of elements or characters in an XML document by default. This flaw allows an attacker to send an excessively large XML request, leading to excessive CPU and memory consumption during pars...

CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...

CVE-2026-107937

In Apache CXF , the parser for multipart/MTOM attachment part headers fails to fully enforce attachment-max-header-size and attachment-headers-max-count limits. Specifically, size limits are only applied to physical lines rather than continuation lines or repeated headers, and count limits check ...

CVE-2026-98208

A flaw was found in the Linux kernel's SDIO UART driver. When registering a new device port while all available port slots are occupied, the driver fails to release an allocated transmit buffer during error handling. A local user could exploit this flaw by repeatedly triggering failed device...

CVE-2026-98206

A flaw was found in the Linux kernel's Cypress Generation 5 touchscreen cyttsp5 driver. This vulnerability can lead to a Denial of Service DoS due to memory corruption because the driver does not properly validate the size of incoming data reports before copying them into a fixed-size buffer. A...

CVE-2026-98204

A flaw was found in the Linux kernel's Synaptics RMI4 SMBus driver. When chunking write requests across the System Management Bus SMBus, the driver miscalculates the remaining data length for the final block. A local user can exploit this issue to trigger an out-of-bounds read past the input...

CVE-2026-61801

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8905-2 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...