29789 matches found
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
SummaryHTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...
PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeonProject: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing"Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
axa-fr-splitter (>=0.0.2, <=0.1.2), cyvoreos (>=0.2.0.3b0, <=0.2.0.7b0) +3 more potentially affected by CVE-2026-55620 via eml-parser (1.17.5)
eml-parser PYPI version 1.17.5 is affected by a known vulnerability. The following packages have a transitive dependency on eml-parser and may be impacted: - axa-fr-splitter =0.0.2, =0.2.0.3b0, =1.0.7, =1.1.1b0, =0.1.13, =0.3.1 Source cves: CVE-2026-55620 Source advisory: OSV:PYSEC-2026-3832...
PYSEC-2026-3833 eml_parser has parser DoS via deeply nested parentheses in e-mail headers
Summary emlparser uses the email.utils.getaddresses function from the CPython standard library to parse e-mail headers that contain e-mail addresses such as To, Cc, Bcc, From, Reply-To, Sender, .... When the input header contains a deeply nested CFWS comment / folding white space construct, the...
PYSEC-2026-3867 NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...
CVE-2026-42805
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...
CVE-2026-42804
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...
CVE-2026-42805
CVE-2026-42805 is a stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library), specifically in the bhi385_parse_debug_message function within bhi385_parse.c. The root cause is that an 8-bit message length field is read directly from an attacker-controlled event payload and u...
CVE-2026-42805
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...
EUVD-2026-75361
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...
CVE-2026-42805
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...
CVE-2026-42804
A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) , affecting versions up to and including commit d6b200416a. The flaw is in bhi360_parse_debug_message() (bhi360_parse.c, lines 1852–1875), where the first payload byte of a debug frame is used as a length and...
CVE-2026-88763
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...
CVE-2026-88763
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...
CVE-2026-88763
A flaw in the skupper-router component of Red Hat Service Interconnect allows denial of service via unbounded recursion in the AMQP field parser . When the router processes a specially crafted network message, the lack of recursion bounds can exhaust stack memory, causing a crash and disrupting t...
CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...
EUVD-2026-75288
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...
CVE-2026-88763 Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...
CVE-2026-88763
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...