CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. Specifically, CBORParser._decodeLongerName() decodes definite-length names without length checks, and CBORParser._decodeChunkedName() valida...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

SummaryLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

EUVD-2026-90881

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking vulnerability discovered by ? in WordPress Npm basic-ftp versions = 6.2.0...

GHSA-C475-QRG2-PJ4R basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RELINE regex has two adjacent \S+?:\s\S+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after ...

SUSE-SU-2026:4410-1 Security update for libX11

This update for libX11 fixes the following issues: - CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. - CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. - CVE-2026-94284: out-of-bounds read vulnerability in libX11's...

Resource Allocation

com.github.java-json-tools, jackson-coreutils is vulnerable to resource allocation. The vulnerability is due to improper resource allocation in the TreePointer.tokensFromInput function of the JSON Pointer parser, which allows a remote attacker to exploit the parser and cause excessive resource...

CLEANSTART-2024-FO72819 Inappropriate implementation in HTML Parser in Google Chrome prior to 101

Security vulnerability affects the chromium package. Inappropriate implementation in HTML Parser in Google Chrome prior to 101...

[SECURITY] Fedora 44 Update: rust-libcst-1.9.0-1.fc44

A Python parser and Concrete Syntax Tree library...

[SECURITY] Fedora 43 Update: rust-libcst-1.9.0-1.fc43

A Python parser and Concrete Syntax Tree library...

CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-LM88265 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the kube-state-metrics-fips package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-EJ17153 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...