CVE-2026-72048

A flaw was found in the Linux kernel. The ieee802154: ca8210 driver fails to free allocated memory casctl when the spiasync operation encounters an error. Under sustained Serial Peripheral Interface SPI bus contention, this can lead to repeated memory leaks. This continuous resource exhaustion ma...

CVE-2026-72045

A flaw was found in the Linux kernel component octeontx2-af. A local attacker with access to a Virtual Function VF could exploit an unsanitized input in the rvumboxhandlerlmtsttblsetup function. This vulnerability allows the VF to read the physical base address of another function's LMTLINE, whic...

EUVD-2026-60323

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0's Vlp32Decoder::unpack() reads past UDP buffer bounds when a short datagram is sent to the Velodyne port, which lacks sender-address restrictions, leaking heap memory into fabricated PointCloud2 messages consumed by Autoware nodes. No in-the-wild exploitation is docum...

CVE-2026-72043

A flaw was found in the Linux kernel, specifically affecting the LoongArch architecture when the hardware page table walker PTW is enabled. This vulnerability stems from a missing dirty page tracking mechanism in the ptewrprotect and pmdwrprotect functions, which can lead to incorrect handling of...

bind security update

An update is available for bind. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...

RLSA-2026:55437 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind9.18 security update

An update is available for bind9.18. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Na...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

EUVD-2026-60321

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions

A flaw was found in HAProxy. An attacker can trigger HPACK dynamic table insertions under memory pressure, leading to a null pointer dereference in the hpackdhtinsert function. This can cause HAProxy worker processes to crash, resulting in a denial of service DoS...

haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions

A flaw was found in HAProxy. An attacker can trigger HPACK dynamic table insertions under memory pressure, leading to a null pointer dereference in the hpackdhtinsert function. This can cause HAProxy worker processes to crash, resulting in a denial of service DoS...

Netty: Memory Exhaustion in SctpMessageCompletionHandler

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...

GHSA-2QJ4-MMR9-4V2F Netty: Memory Exhaustion in SctpMessageCompletionHandler

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...