AZL-98265 CVE-2026-42395 affecting package dovecot 2.3.20-1

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

ALPINE-CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42395

CVE-2026-42395 affects Dovecot (OX Dovecot by Open-Xchange, per the advisory reference). A host listed as a trusted proxy can send forwarding information containing a NUL byte , which crashes the login process on the next login attempt, causing degradation or denial of service for logins. Deploym...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

EUVD-2026-67677

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

UBUNTU-CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

PT-2026-83070

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description A host configured as a trusted proxy can send forwarding information containing a NUL byte. This causes the login process to crash during the subsequent login attempt, leading to process...

CVE-2026-81525

CVE-2026-81525 is a cross-tenant database retargeting vulnerability in the MongoDB client library for PHP (mongo-php-library and mongo-php-driver). The root cause is insufficient sanitization of dot and NUL characters in application-supplied namespace identifiers, allowing an attacker with low pr...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81524 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation flaw in MongoDB libmongocrypt 's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The CVELIST record further specifies the mechanism as dot/NUL injection in namespace strings, enabling cross-tenant data...

CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...