Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match

A flaw was found in PCRE2, a library for processing regular expressions. The pcre2jitmatch function, which handles just-in-time JIT compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

USN-8915-1: FFmpeg vulnerabilities

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-30754 It...

K000163675: libssh vulnerability CVE-2026-59848

Security Advisory Description A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. CVE-2026-59848 Impact An attacker could cause SFTP client...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

pcre2: pcre2: Out-of-bounds write via crafted regular expression

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match

A flaw was found in PCRE2, a library for processing regular expressions. The pcre2jitmatch function, which handles just-in-time JIT compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to...

CVE-2022-47529

CVE-2022-47529 RSA NetWitness Platform EDR Agent / Incorrect Access Control - Code Execution During a security audit of the EDR agent I discovered a novel vector to tamper with the service with only standard user rights by targeting an insecure Win32 memory event object. Hijacking the service...

CVE-2026-109380

A flaw was found in modern-tar. A remote attacker can trigger a Denial of Service DoS by supplying a specially crafted archive containing malformed entry size values. When processing the invalid data, the parser fails to properly calculate file sizes and buffers data indefinitely, leading to memo...

CVE-2026-96265

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory,...

CVE-2026-96266

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage...

CVE-2026-96261

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash...

CVE-2026-109380

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2026-109380

The modern-tar library (versions 0.3.5 through 0.8.5) is vulnerable to a memory exhaustion Denial of Service (DoS) condition. The root cause lies in the readOctal() function, which fails to properly validate non-octal bytes, allowing an attacker to produce negative entry sizes . By providing a sp...

EUVD-2026-97878

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...