CVE-2026-115774

A flaw was found in Twisted. An authenticated remote attacker can send a specially crafted search command with a negative size to the Internet Message Access Protocol IMAP service, triggering an infinite processing loop. This flaw leads to a Denial of Service DoS, freezing the application and...

Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

DEBIAN-CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

UBUNTU-CVE-2026-97451

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

PT-2026-98085

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the ACPICA component within the acpi ex opcode 3A 1T 1R mid op function. The issue occurs when calculating the truncation length due to a lack of overflow...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

Astra Linux – Vulnerability in lz4

There is a flaw in lz4. An attacker who submits a crafted file to an application that uses lz4 may be able to trigger an integer overflow, resulting in the call to memmove with a negative size argument. This can lead to an out-of-bounds write and/or a system crash. The most significant impact of...

DEBIAN-CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

PT-2026-88459

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1 Description Memory corruption occurs during the RTP encoding process when transmitting H.264/HEVC streams via RTP using a crafted input file. In the nal send function within libavformat/rtpenc h264 hevc.c, a negati...

CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

SUSE CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

ANT-2026-3JR8RVFB · Leptonica · Heap Buffer Underflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3JR8RVFB: Heap buffer underwrite via negativ...

SUSE CVE-2026-67214

nanoid Nano ID before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module nanoid/non-secure. When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination conditio...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

EulerOS 2.0 SP11 : libsolv (EulerOS-SA-2026-3078)

According to the versions of the libsolv packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted .solv file containing...

DoS (Denial of Service) tar Dependency in Jira Software Data Center

This DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...