47 matches found
SUSE CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Erlang/OTP inets httpc contains an improper validation flaw where server-supplied Content-Length and Retry-After header values are converted via unbounded list_to_integer/1 before size checks can apply. A malicious HTTP server can return a numeric header with up to roughly 1.26 million digits , c...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
PT-2026-84263
Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 Description Improper validation of input quantities in the inets httpc module allows a malicious or compromised HTTP...
CVE-2026-71562: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
PT-2026-89923
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc handler.erl converts the server-supplied Content-Length wi...
CLSA-2026-1783698569 httpd: Fix of 6 CVEs
CVE-2026-44186: modproxyftp: fix infinite loop parsing the Retry-After delay in an FTP response - advance the scan pointer so the whitespace-prefixed digit search terminates...
CLSA-2026-1782160524 httpd: Fix of 12 CVEs
CVE-2026-44186: modproxyftp: fix infinite loop parsing the Retry-After delay in an FTP response - advance the scan pointer so the whitespace-prefixed digit search terminates...
CLSA-2026-1782160246 httpd: Fix of 14 CVEs
CVE-2026-44186: modproxyftp: fix infinite loop parsing the Retry-After delay in an FTP response - advance the scan pointer so the whitespace-prefixed digit search terminates...
GHSA-CR7P-CR3Q-H5CM Budibase: Account Enumeration via Login Lockout Response Differential
Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct 403 response with...
PT-2026-67597
Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct 403 response with...
CLSA-2026-1782987193 Fix CVE(s): CVE-2026-44186
SECURITY UPDATE: infinite loop in modproxyftp Retry-After parsing - debian/patches/CVE-2026-44186.patch: advance the scan pointer while searching for the delta-seconds digit in an FTP error response Retry-After header in modules/proxy/modproxyftp.c so the loop terminates instead of spinning forev...
BIT-LIBPYTHON-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer...
CLSA-2026-1782153378 httpd: Fix of 3 CVEs
CVE-2026-44186: fix infinite loop in modproxyftp when scanning the FTP Retry-After message for the delta-seconds value...
CVE-2026-46137
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: fix potential data-race This mptcppmaddtimer helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bhlocksock. If the socket is in use,...
CVE-2026-28481
OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader optional extension must be enabled that leaks bearer tokens to allowlisted suffix domains. When retrying downloads after receiving 401 or 403...