EUVD-2026-50085

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

MGASA-2026-0273 Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

CVE-2026-64620

FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an...

SUSE-SU-2026:3076-1 Security update for libssh2_org

This update for libssh2org fixes the following issue - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530...

JLSEC-2026-660 libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

SUSE-SU-2026:22364-1 Security update for libssh2_org

This update for libssh2org fixes the following issues - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. - CVE-2026-55200: out-of-Bounds write via Unchecked packetlength in transport.c bsc1268531...

CVE-2026-55199

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

CVE-2026-55199

CVE-2026-55199 affects libssh2 up to version 1.11.1. The vulnerability lies in the SSH_MSG_EXT_INFO handler (src/packet.c), where return values from _libssh2_get_string() are unchecked. During key exchange, a malicious SSH server can set nr_extensions to 0xFFFFFFFF, causing the client to spin in ...

Linux Distros Unpatched Vulnerability : CVE-2026-9742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When OIDC authentication is enabled in configuration, clients may set specific values in the mechanism parameter of the authenticate command that lead to server...

DEBIAN-CVE-2026-42189

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for...

CVE-2026-42189

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for...

GHSA-F5V4-2WR6-HQMG russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

Summary A pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for 2FA/TOTP with a single malformed packet, requiring no credential...

CVE-2026-27890 Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCTspecificdata segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow...

CVE-2026-39312

CVE-2026-39312 affects SoftEtherVPN Developer Edition 5.2.5188 and earlier. It is a pre-authentication denial-of-service where an unauthenticated remote attacker can crash the vpnserver by sending a malformed EAP-TLS packet over raw L2TP (UDP/1701), terminating all active VPN sessions. The root c...

EUVD-2026-19804

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authentication denial-of-service vulnerability exists in SoftEther VPN Developer Edition 5.2.5188 and likely earlier versions of Developer Edition. An unauthenticated remote attacker can cra...

CVE-2026-33952

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggers a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABR...

CVE-2026-33219 NATS is vulnerable to pre-auth DoS through WebSockets client service

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a...

GHSA-8R68-GVR4-JH7J NATS is vulnerable to pre-auth DoS through WebSockets client service

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients. Problem Description A malicious...

CVE-2025-55184

CVE-2025-55184 is a pre-authentication Denial of Service vulnerability in React Server Components from versions 19.0.0 through 19.2.2 (affecting react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack). The issue arises from unsafe deserialization of HTTP payloads sent t...