CVE-2026-97705

The Moleculer microservices framework for Node.js is vulnerable to an unauthenticated Denial of Service (DoS) in versions prior to 0.14.36 and 0.15.2 . The root cause is located in the Parser._write function within src/transporters/tcp/parser.js, where Buffer.prototype.readInt32BE is used to read...

CVE-2022-20474

CVE-2022-20474 Analysis — Self-changed Bundle under LazyValue Preface A friendly reminder: before reading this article, you should have a basic understanding of Bundle Mismatch vulnerabilities. If you haven't read the following references, it is recommended to read them first: 1. Bundle Feng Shui...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iouring/net: fix slab-out-of-bounds read in iobundlenbufs sqe-len is u32 but gets stored into sr-len which is int. When userspace passes sqe-len values exceeding INTMAX e.g., 0xFFFFFFFF, sr-len overflows to a negative value. This...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf In ofmodalias, we can pass the str and len parameters, which would cause a kernel oops in vsnprintf since it only allows passing a NULL pointer when the length is also 0...

CVE-2026-90157

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the BPF Berkeley Packet Filter cgroup getsockopt hook. By providing a negative length value, a malicious BPF program could cause the kernel's memory copy function to process an invalid size. This could lead to...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2024_6989)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246989 advisory. libexpat: Negative Length Parsing Vulnerability in libexpat CVE-2024-45490 libexpat: Integer Overflow or Wraparound CVE-2024-45491 libexpat: integer overfl...

Rocky Linux 9 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2024_6754)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246754 advisory. libexpat: Negative Length Parsing Vulnerability in libexpat CVE-2024-45490 libexpat: Integer Overflow or Wraparound CVE-2024-45491 libexpat: integer overfl...

CLSA-2026-1790730632 gstreamer1-plugins-base: Fix of 2 CVEs

CVE-2026-18297: opusdec: don't use channel positions for more than 64 channels, preventing an out-of-bounds write in gstopusdecnegotiate - CVE-2026-85150: rtsp/message: fix negative length passed to gstrndup when an auth param value starts with whitespace...

CLSA-2026-1790255794 gstreamer1-plugins-base: Fix of 2 CVEs

CVE-2026-18297: opusdec: don't use any channel positions for more than 64 channels, preventing out-of-bounds writes to the fixed-size 64-element channel position array in gstopusdecnegotiate - CVE-2026-85150: rtsp/message: use the end of the item after skipping whitespace when parsing an auth...

GHSA-86WM-R4C5-2RC9 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Summary Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose...

CVE-2026-61695 Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

CVE-2026-61695

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

CVE-2026-61695

The Wire Swift runtime (wire-runtime-swift) is vulnerable to a Denial of Service attack because ProtoReader.skipGroup() fails to reject negative lengths for LENGTH_DELIMITED fields within unknown START_GROUP fields. A crafted 10-byte protobuf payload can cause ReadBuffer.readData(count:) to pass ...

CVE-2026-61695: Improper Validation of Array Index

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroupexpectedEndTag:unknownFieldsWriter: accepts a negative length for a LENGTHDELIMITED field inside an unknown STARTGROUP field...

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire's Swift runtime Wire SPM/CocoaPods product, implemented by wire-runtime-swift did not reject a negative LENGTHDELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup to read a length-delimited field whose varint...

CLSA-2026-1789553486 libxml2: Fix of 2 CVEs

CVE-2026-86143: guard the sizet buffer length against INTMAX before it is narrowed to the int passed to writecallback in xmlOutputBufferWrite, xmlOutputBufferWriteEscape and xmlOutputBufferFlush xmlIO.c, so a negative length can no longer reach an output callback - CVE-2026-86144: propagate the...

com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

com.github.luben/zstd-jni: zstd-jni: Denial of Service via negative length parameter

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

CLSA-2026-1789554546 libxml2: Fix of 2 CVEs

CVE-2026-86143: guard the sizet buffer length against INTMAX before it is narrowed to the int passed to writecallback in xmlOutputBufferWrite, xmlOutputBufferWriteEscape and xmlOutputBufferFlush xmlIO.c, so a negative length can no longer reach an output callback - CVE-2026-86144: propagate the...

CLSA-2026-1789554317 libxml2: Fix of 2 CVEs

CVE-2026-86143: guard the sizet buffer length against INTMAX before it is narrowed to the int passed to writecallback in xmlOutputBufferWrite, xmlOutputBufferWriteEscape and xmlOutputBufferFlush xmlIO.c, so a negative length can no longer reach an output callback - CVE-2026-86144: propagate the...