EUVD-2026-105012

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow is a Java web server based on non-blocking IO. It consists of a few different parts: A core HTTP server that supports both blocking and non-blocking IO A Servlet 3.1 implementation A JSR-356 compliant web socket implementation Website: http://undertow.io Issues:...

tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes

A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote user sending a follow-up request could receive sensitive...

PT-2026-118375

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M25 through 11.0.26 Description A buffer under-read occurs in the HTTP/1.1 non-blocking write path. This issue allows a large response body to be split between the current request and the subsequent request receiv...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Denial of Service vulnerability in Jackson Core (CVE-2026-18401)

Summary A security vulnerability CVE-2026-18401 has been identified in the Jackson Core library used by IBM Engineering Lifecycle Optimization - Engineering Publishing. The non-blocking async JSON parser fails to enforce the maxNumberLength constraint default: 1,000 characters defined in...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length...

Astra Linux – Vulnerability in Linux

A vulnerability was discovered in the Linux kernel, where the non-blocking socket operation in llcpsockconnect leads to a leak and ultimately causes the system to hang...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Do not check if plane-state-fb == state-fb Currently, when using non-blocking commits, the following kernel warnings can be observed: 110.908514 ------------ Cut here ------------ 110.908529 refcountt: Underflow; Use aft...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a – fixed blocking and non-blocking rng logic The blocking and non-blocking paths failed to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1 only fetched 32 byte...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes

A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote user sending a follow-up request could receive sensitive...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: aio: Fixed a use-after-free issue due to missing POLFREE handling. signalfdpoll and binderpoll are special because they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This...

CLEANSTART-2026-GT01967 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...