DEBIAN-CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

UBUNTU-CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

BIT-MONGODB-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

PT-2026-94392

Name of the Vulnerable Software and Affected Versions vgmstream affected versions not specified Description A remote attack can trigger a divide by zero error within the AWB parser component. The issue resides in the init vgmstream awb memory function located in the src/meta/awb.c file...

PT-2026-95163

Name of the Vulnerable Software and Affected Versions redis-parser versions prior to 3.0.1 Description A denial of service issue exists in the RESP Redis Serialization Protocol parser. Malicious Redis endpoints can crash the client process by sending crafted RESP byte streams containing repeated...

PT-2026-94241

Name of the Vulnerable Software and Affected Versions Redis community affected versions not specified Description The cluster bus packet parser, which handles PING, PONG, and MEET packets, does not properly validate string-carrying extensions for null-termination. This allows a remote attacker to...

PT-2026-94374

Name of the Vulnerable Software and Affected Versions vgmstream versions prior to r2118 Description A weakness in the EA SCHl parser component allows for remote exploitation. The issue occurs within the vadpcm read coefs be function located in the src/coding/vadpcm decoder.c file. Manipulation of...

CVE-2026-92881: Divide By Zero

A security vulnerability has been detected in vgmstream. The affected element is the function initvgmstreamawbmemory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is...

CVE-2026-92925: Out-of-bounds Read

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

CVE-2026-92880: Out-of-bounds Write

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcmreadcoefsbe of the file src/coding/vadpcmdecoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible...

CVE-2026-93435: Uncontrolled Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-90112: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

PT-2026-94460

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The unified ROM parser in the qlcnic driver fails to properly validate directory, product, and data-descriptor fields within firmware files. The validation process uses unchecked additio...

CVE-2026-90143: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

PT-2026-94354

Name of the Vulnerable Software and Affected Versions Sanic version 25.12.0 Description Sanic's core HTTP/1.1 parser fails to fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place...

EUVD-2026-81015

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...