QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fixed UAF in hciaclcreateconnsync This fixed the following UAF in hciaclcreateconnsync where a connection that is still pending may be freed after command submission conn-state == BTOPEN. This issue can also...

CVE-2025-39982

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fix UAF in hciaclcreateconnsync This fixes the following UFA in hciaclcreateconnsync where a connection still pending is command submission conn-state == BTOPEN maybe freed, also since this also can happen wi...

DEBIAN-CVE-2015-2689

Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service assertion failure and daemon exit via crafted packets...