CVE-2026-118488 Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, when a malicious server keeps sending bytes on an EOL-terminated line not length-prefixed, for example a simple string 1, we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for...

CVE-2026-118488 Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, when a malicious server keeps sending bytes on an EOL-terminated line not length-prefixed, for example a simple string 1, we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the Redis reply parser fails to limit recursion depth; as a result, remote peers on the Redis server return deeply nested RESP array replies, potentially causing the bRPC...

ai.pipestream.module:module-opensearch-sink (0.1.1), ai.pipestream.module:module-testing-sidecar (0.0.1) +147 more potentially affected by CVE-2026-102465 via io.vertx:vertx-redis-client (>=4.0.0, <=4.5.34)

io.vertx:vertx-redis-client MAVEN version =4.0.0, =0.1.7, =2026.07.08, =2026.04.24-1, =2026.07.08, =1.1.0, =1.0.1, =0.8.1, =0.7.0, =0.7.0, =0.9.0 and more Source cves: CVE-2026-102465 Source advisory: MEND:CVE-2026-102465...

dev.vertique:vertique-cache-redis (>=0.2.0, <=0.3.0), dev.vertique:vertique-rate-limit-redis (>=0.2.0, <=0.3.0) +27 more potentially affected by CVE-2026-102465 via io.vertx:vertx-redis-client (>=5.1.0, <=5.1.9)

io.vertx:vertx-redis-client MAVEN version =5.1.0, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 - io.quarkus:quarkus-oidc-redis-token-state-manager 4.0.0.beta1 - io.quarkus:quarkus-oidc-redis-token-state-manager-deployment 4.0.0.beta1 - io.quarkus:quarkus-redis-cache 4.0.0.beta1 -...

PT-2026-114823

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle...

CVE-2026-102465: Allocation of Resources Without Limits or Throttling

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle...

TencentOS Server 3: apr-util (TSSA-2026:1149)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1149 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

AlmaLinux 9.2 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786553851)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786553851 advisory. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords...

Rocky Linux 8 [CIQ] Security Update: apr-util / apr-util-bdb / apr-util-bdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_69113)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669113 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Information...

Rocky Linux 9 [CIQ] Security Update: apr-util / apr-util-bdb / apr-util-bdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_66341)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202666341 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Information...

AlmaLinux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786481279)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786481279 advisory. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from...

Rocky Linux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786481279)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786481279 advisory. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library ...

RLSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client

A flaw was found in the Redis client in the Apache Portable Runtime Utility apr-util. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service...

Moderate: Red Hat Security Advisory: apr-util security update

An update for apr-util is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 8 : apr-util (RHSA-2026:69113)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69113 advisory. The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains...

ALSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library...