30796 matches found
CVE-2026-18376
Koji's SCM URL parser normalizes repository paths using urllib.parse.urlparse and os.path.normpath before evaluating them against the configured SCM policy. Because normpath decodes percent-encoded sequences at policy-check time but the underlying Git HTTP transport decodes them again during fetc...
Exploit for CVE-2026-69243
CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request...
CVE-2026-13697
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...
GHSA-642R-3GJ9-2PJ5 Duplicate Advisory: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7wm-3cxj-wff9. This link is maintained to preserve external references. Original Description The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint...
Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72hv-8253-57qq. This link is maintained to preserve external references. Original Description The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in...
GHSA-6QM2-MCQ7-53QP Duplicate Advisory: jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72hv-8253-57qq. This link is maintained to preserve external references. Original Description The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in...
CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-18401
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
UBUNTU-CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
UBUNTU-CVE-2026-18401
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-18401
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CLSA-2026-1784856386 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1...
CLSA-2026-1784769501 TuxCare security update for socket.io-parser (1 CVE)
TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.2.0-tuxcare.2...
CLSA-2026-1784596340 TuxCare security update for body-parser (1 CVE)
TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.0-tuxcare.1...
CLSA-2026-1784596325 TuxCare security update for ua-parser-js (2 CVEs)
TuxCare rebuilt ua-parser-js to address 2 CVEs. Fixed in 0.7.22-tuxcare.1...
CLSA-2026-1784596302 TuxCare security update for body-parser (1 CVE)
TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.2...