Lucene search
+L

440 matches found

EUVD
EUVD
•added 2026/09/26 1:23 p.m.•2 views

EUVD-2026-87756

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...

8.7CVSS5.7AI score
SaveExploits0References2
EUVD
EUVD
•added 2026/09/26 1:23 p.m.•3 views

EUVD-2026-87755

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

8.7CVSS5.8AI score
SaveExploits0References2
EUVD
EUVD
•added 2026/09/26 1:23 p.m.•2 views

EUVD-2026-87752

Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...

6.9CVSS5.8AI score
SaveExploits0References2
EUVD
EUVD
•added 2026/09/26 1:23 p.m.•3 views

EUVD-2026-87749

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

7.5CVSS5.7AI score
SaveExploits0References2
Kitploit
Kitploit
•added 2026/09/25 12:04 a.m.•13 views

TomcatKiller-CVE-2025-31650

TomcatKiller-CVE-2025-31650 脆弱性 CVE-2025-31650 を検出するために設計されたツールです。Apache Tomcat(バージョン 10.1.10 から 10.1.39)が対象です。 この脆弱性により、攻撃者は無効な優先度ヘッダーを含む特別に細工されたHTTP/2リクエストを送信することでメモリリーク を引き起こし、OutOfMemoryError によるサービス拒否(DoS)状態を引き起こすことができます。...

7.5CVSS7.8AI score0.61039EPSS
SaveExploits5
Cvelist
Cvelist
•added 2026/09/24 10:03 p.m.•27 views

CVE-2026-87722 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-1333 in regex search query predicates such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates and REST regex filter endpoints RegexListSearcher /projects/?r= and RefFilter /projects/project/branches/?r= in Gerrit...

8.7CVSS0.00322EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/23 6:41 p.m.•32 views

CVE-2026-59990

The open-source JSON parser Jawn is vulnerable to a denial of service attack due to uncontrolled nesting depth in JSON arrays and objects. An attacker can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted , triggering a java.lang.OutOfMemoryError that is not handled by...

7.5CVSS5.9AI score0.00623EPSS
SaveExploits0References6
OSV
OSV
•added 2026/09/23 6:41 p.m.•3 views

CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

7.5CVSS6AI score
SaveExploits0References8
RedhatCVE
RedhatCVE
•added 2026/09/23 5:04 p.m.•5 views

CVE-2026-69219

A flaw was found in the RabbitMQ Java client library. A malicious AMQP Advanced Message Queuing Protocol peer can exploit this by sending a specially crafted message during the pre-authentication phase. This message can cause the client to allocate an excessively large amount of memory, leading t...

8.7CVSS5.7AI score0.00725EPSS
SaveExploits0References9
RedhatCVE
RedhatCVE
•added 2026/09/23 5:46 a.m.•5 views

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

7.5CVSS5.9AI score0.00492EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
•added 2026/09/23 5:01 a.m.•11 views

Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...

8.7CVSS6AI score0.0063EPSS
SaveExploits0Affected Software1
NVD
NVD
•added 2026/09/23 3:17 a.m.•9 views

CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS0.00492EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/23 3:17 a.m.•7 views

DEBIAN-CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS5.8AI score0.00492EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 2:06 a.m.•53 views

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS0.00492EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/23 2:06 a.m.•8 views

EUVD-2026-85000

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS5.8AI score0.00492EPSS
SaveExploits0References2
Debian CVE
Debian CVE
•added 2026/09/23 2:06 a.m.•9 views

CVE-2026-89425

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS5.8AI score0.00492EPSS
SaveExploits0
CVE
CVE
•added 2026/09/23 2:06 a.m.•45 views

CVE-2026-89425

The FasterXML jackson-core library contains a vulnerability in the UTF8DataInputJsonParser._reportInvalidToken() method. The root cause is that this specific parser fails to honor ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) when building error messages, unlike other sibling im...

7.5CVSS5.8AI score0.00492EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/23 2:06 a.m.•6 views

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

7.5CVSS5.8AI score
SaveExploits0References6
Tenable Nessus
Tenable Nessus
•added 2026/09/23 12:00 a.m.•6 views

Linux Distros Unpatched Vulnerability : CVE-2026-89425

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier...

7.5CVSS5.8AI score0.00492EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/22 1:04 p.m.•6 views

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

7.5CVSS5.8AI score0.00548EPSS
SaveExploits0References4
Rows per page
Query Builder