CVE-2026-55200

🚨 CVE-2026-55200 - 严重 libssh2 越界写入漏洞 📌 概述 CVE-2026-55200 是一个影响广泛部署的 libssh2 库的严重内存损坏漏洞 。 该缺陷源于 SSH 数据包处理过程中对数据包长度字段验证不当，可能允许远程攻击者触发堆损坏，并在特定情况下实现远程代码执行 RCE 。 🔥 严重性 指标| 值 ---|--- CVE ID| CVE-2026-55200 严重性| 严重 CVSS 分数| 9.2 攻击向量| 网络 所需权限| 无 用户交互| 无 影响| RCE / DoS 🎯 受影响软件 组件| 受影响版本 ---|--- libssh2| =...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Avoid reading uninitialized memory in ath9khtcrxmsg. syzbot reports that the uninitialized value is accessed at ath9khtcrxmsg. For ioctlUSBRAWIOCTLEPWRITE, the function ath9khifusbrxstream may call ath9khtcrxmsg with...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: Check the packet for fixup for true limits. If a device sends a packet that lies between 0 and sizeofu64, the value passed to skbtrim as the packet length will wrap around, resulting in a very large value. The driver...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: added more sanity checks to qdiscpktleninit. One of the approaches handles SKBGSODODGY, assuming that skb-len is greater than hdrlen. The function virtionethdrtoskb does not fully dissect TCP headers; it only ensures that th...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Do not redirect packets with invalid pktlen Syzbot identified an issue 1: the fqcodel Drop function attempts to drop a flow without any SKBs, that is, when flow-head is null. The root cause, as stated in 2, is that the...

Astra Linux – Vulnerability in libslirp

In ncsi.c within libslirp up to 4.3.1, there is an issue of buffer over-reading. This occurs because the program attempts to read a certain amount of header data, even when that amount exceeds the total packet length...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: The length of the packet header is validated before calling skbPut. When receiving a vsock packet in the guest, only the size of the virtqueue buffer is validated prior to calling virtiovsockskbrxPut. Unfortunately,...

EUVD-2026-75363

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINESSDK versions 2.10 through 2.12.2 allows attackers to cause a denial of service process crash or potentially execute arbitrary code. The bridge decoder bridgedecoder.c trusts the packet length fiel...

EUVD-2026-70800

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo and negative size conversi...

CVE-2026-85440

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo and negative size conversi...

CVE-2026-85442 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten, allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory an...

CVE-2026-85440 MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo and negative size conversi...

CVE-2026-85440 MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo and negative size conversi...

CVE-2026-85440

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow in the MOOSCommPkt packet-handling code. During the HandShake phase , a remote attacker can declare a negative packet length , which bypasses the signed integer check in InflateTo() and causes a negative size conversion in ...

PT-2026-85291

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description An issue exists where the software fails to validate packet length declarations in the CMOOSCommPkt::OnBytesWritten function. This allows unauthenticated attackers to trigger unbounded buffer...

PT-2026-85289

Name of the Vulnerable Software and Affected Versions core-moos versions prior to 10.4.1 Description A pre-authentication heap overflow exists in MOOSCommPkt packet handling. Remote attackers can write arbitrary data by declaring a negative packet length. This is achieved by exploiting a signed...

Linux Distros Unpatched Vulnerability : CVE-2026-75538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length...

CVE-2026-75538

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...

CVE-2026-75538

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...

EEF-CVE-2026-75538 A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

Summary An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocate...