SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4023-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4023-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to...

SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4105-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4105-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncatio...

SUSE-SU-2026:4105-1 Security update for libsoup

This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Changes for libsoup2: update after changes in the public suffix list: ".bd" is no longer in the public suffix list so let's use ".jm" instead...

SUSE-SU-2026:3936-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Changes for libsoup2: - tld-test: update after changes in the public suffix list: '.bd' is no longer in the public suffix list so let's use...

CVE-2026-45705: Out-of-bounds Read

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

PT-2026-67893

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description The find line delimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. This occurs...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730: Loop with Unreachable Exit Condition

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

Denial Of Service (DoS)

starlite is vulnerable to Denial of Service DoS attacks. A malicious user is able to consume a large amount of CPU time and RAM because the multipart body parser accepts an unlimited number of file parts and field parts, which can cause the application to crash...

GHSA-P24M-863F-FM6Q Denial of service vulnerability when parsing multipart request body

Summary The request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. Details The multipart body parser processes an unlimited number of file parts. The multipart body parser processes an unlimited number of field parts. Impact...

CVE-2023-25578

Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in "starlite" allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts an...

CVE-2023-25578: Allocation of Resources Without Limits or Throttling

Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...

GHSA-HPP2-2CR5-PF6G Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

PT-2023-20174

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 6.0.1 and 7.4.1 Description The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body pars...