180419 matches found
DEBIAN-CVE-2026-100236
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
CVE-2026-100236
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
EUVD-2026-101381
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface...
CVE-2026-102056
Juniper Networks Junos OS and Junos OS Evolved are affected by an Out-of-bounds Read vulnerability in the cfmd process . An unauthenticated attacker on an adjacent network can crash the daemon and disclose limited process memory by sending a specific CFM Message to a configured interface. Informa...
CVE-2026-102056 Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface...
CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...
CVE-2026-75085
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c is vulnerable to an out-of-bounds read due to a length underflow. The driver calculates packet length by subtracting IEEE802154_FCS_LENGTH from the radio-reported length without first verifying that the reported length ...
CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...
CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...
CVE-2026-19673
The Zephyr RTOS Ethernet L2 layer contains an out-of-bounds read and net_buf length underflow in subsys/net/l2/ethernet/ethernet.c. When parsing a truncated VLAN header (ethertype 0x8100), the ethernet_recv() function fails to re-verify the buffer length when reinterpreting the header as an 18-by...
CVE-2026-19673 Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...
CVE-2026-101946 Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used
An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...
EUVD-2026-101324
An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...
CVE-2026-101946
An Out-of-bounds Read vulnerability exists in the rpd process of Juniper Networks Junos OS and Junos OS Evolved . An adjacent low-privilege attacker can exploit this by sending an IPv6 LDP message , potentially resulting in the disclosure of limited rpd process memory and the disruption of an LDP...
CVE-2026-100236 Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
CVE-2026-100236
A heap out-of-bounds read/write vulnerability exists in the DPDK GSO library . The issue occurs because the software GSO fails to verify if a packet header fits within the source first segment or the destination buffer during a copy to a new mbuf. A header exceeding the configured GSO segment siz...
CVE-2026-100236
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
EUVD-2026-101484
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
CVE-2026-100236
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...
USN-8930-1: U-Boot vulnerabilities
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. CVE-2026-74220, CVE-2026-74221...