AZL-107661 CVE-2026-107324 affecting package kubevirt 1.8.4-2

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

AZL-107907 CVE-2026-107325 affecting package telegraf 1.31.0-33

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

CVE-2026-107324

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

AZL-107865 CVE-2026-107325 affecting package skopeo 1.14.4-13

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

AZL-107697 CVE-2026-107325 affecting package libcontainers-common 20240213-3

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

AZL-107057 CVE-2026-107325 affecting package cri-o 1.30.1-1

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

AZL-107558 CVE-2026-107324 affecting package kata-containers 4.1.0.kata0-1

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

AZL-107123 CVE-2026-107324 affecting package podman 5.6.1-10

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

CVE-2026-107324

The MongoDB Go Driver is vulnerable to a denial of service (DoS) attack due to an integer overflow in BSON value-length validation. When an application processes a malformed BSON document, the overflow can trigger a runtime panic , potentially terminating unprotected application processes. An una...

EUVD-2026-94526

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic...

GHSA-MX22-3794-2VPV Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

EUVD-2026-94530

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element...

GHSA-2J4C-FFCH-9F23 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...

EUVD-2026-94533

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS...

GHSA-X2Q3-8CJH-766F Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...