CVE-2021-28476

CVE-2021-28476: Microsoft Hyper-V: Multiple Vulnerabilities in vmswitch Multiple bugs are present in WPP code when handling set OID requests, one of them allowing to dereference read access an attacker controlled pointer, and the rest causing out of bounds read accesses. This repository contains...

SUSE CVE-2026-118775

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

Linux Distros Unpatched Vulnerability : CVE-2026-118775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not...

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Summary asn1.oidToDer did not range-check the first two arcs of an OID string, so an OID such as 0.42.840.113549.1.1.1 or 4294977127.18.840.113549.1.1.1 was encoded as the DER of a different OID here rsaEncryption, 1.2.840.113549.1.1.1. This is an incomplete fix of CVE-2025-66030. Fixed in...

EUVD-2026-113332

Forge: ASN.1 OID first arc truncation in asn1.oidToDer...

GHSA-4642-5MCJ-2RQW Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Summary asn1.oidToDer did not range-check the first two arcs of an OID string, so an OID such as 0.42.840.113549.1.1.1 or 4294977127.18.840.113549.1.1.1 was encoded as the DER of a different OID here rsaEncryption, 1.2.840.113549.1.1.1. This is an incomplete fix of CVE-2025-66030. Fixed in...

UBUNTU-CVE-2026-118775

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775

The Forge (node-forge) JavaScript TLS implementation is vulnerable in versions prior to 1.4.1 due to a missing range-check in the asn1.oidToDer() function within lib/asn1.js . An attacker providing an untrusted OID string that the application authorizes could cause the software to emit a DER repr...

CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

PT-2026-132789

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description The asn1.oidToDer function in lib/asn1.js fails to perform range-checking on the first two arcs of an Object Identifier OID. This allows an application that accepts and authorizes an untrusted OID stri...

CVE-2026-118775: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

NetX Duo 6.5.2.202603 Out-Of-Bounds Read

NetX Duo version 6.5.2.202603 and earlier contains an out-of-bounds read in the SNMP OID parser when processing multi-byte BER lengths...

Rocky Linux 8 [CIQ] Security Update: python3-pyasn1 / python3-pyasn1-modules (crlsa-2026_4146)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20264146 advisory. pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-23490 Tenable has extracted the preceding description block directly...

CentOS Linux 7 [TuxCare] Security Update: python2-pyasn1 / python2-pyasn1-modules (CENTOS7:CLSA-2026:1774431305)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1774431305 advisory. - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2026_1903)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261903 advisory. pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-23490 Tenable has extracted the preceding description block directly...