30510 matches found
CVE-2026-84378 HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...
[SECURITY] [DLA 4768-1] libapache2-mod-auth-openidc security update
Debian LTS Advisory DLA-4768-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert September 02, 2026 https://wiki.debian.org/LTS Package : libapache2-mod-auth-openidc Version : 2.4.12.3-2+deb12u5 CVE ID : CVE-2026-54789 A vulnerability has been found in modauthopenidc...
CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
CVE-2026-82522
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
EUVD-2026-70241
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
CVE-2026-82522
libjxl before version 0.12.0 contains an integer underflow vulnerability in the container box parser . On 32-bit platforms , 64-bit box sizes are truncated to size_t, allowing a remote attacker to supply a crafted JPEG XL file that causes the decoder to parse attacker-controlled codestream bytes ...
CVE-2026-82522 libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...
CVE-2026-0915-json-Patch.-V2.0
Uploading 1000000837.png… CVE-2026-0915-json-Patch.-V2.0 Patch the Bug - glibc 🔒 JSON Validator Security Patch Enterprise-grade solution for CVE-2026-0915 - Protects against insecure JSON parsing through strict schema validation. 🚨 Security Notice This patch fixes CVE-2026-0915 - a critical...
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
DEBIAN-CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
UBUNTU-CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
CVE-2026-53600
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
CVE-2026-53600 async-tar PAX extension-header desync enables tar entry/content smuggling
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
EUVD-2026-70200
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...
EUVD-2026-64758
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references...
EUVD-2026-64772
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization...
EUVD-2026-64773
fast-uri vulnerable to host confusion via percent-encoded scheme normalization...
CVE-2026-78689
NGINX JavaScript (njs) contains a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. Both the njs and QuickJS (qjs) engines are affected. With njs, the out-of-bounds write corrupts adjacent objects and crashes the N...
CVE-2026-78689 NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...