Moderate: Red Hat Security Advisory: fetchmail security update

An update for fetchmail is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

Moderate: Red Hat Security Advisory: fetchmail security update

An update for fetchmail is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

Security Bulletin: Vulnerabilities in libxml2 (CVE-2026-86140, CVE-2026-86141, CVE-2026-86143, CVE-2026-86144) affect AIX.

Summary Vulnerabilities in libxml2 could cause stack-based buffer overflow CVE-2026-86140, A NULL pointer dereference CVE-2026-86141, An integer overflow CVE-2026-86143, denial-of-service CVE-2026-86144. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details...

Security Bulletin: IBM QRadar SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-102276, CVE-2026-102277, CVE-2026-102278)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-102276 DESCRIPTION: The brace-expansion library generates...

CVE-2026-82230 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser

Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nsheadmcpack / ubrpc / publicpbrpc requests recursively pars...

CVE-2026-82230

Apache bRPC (versions prior to 1.18.0 ) is vulnerable to a denial of service via uncontrolled recursion in the mcpack2pb component. The parser, used for nshead_mcpack, ubrpc, and public_pbrpc requests, fails to enforce a depth limit when processing nested objects and arrays. A remote attacker can...

CVE-2026-82230 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser

Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nsheadmcpack / ubrpc / publicpbrpc requests recursively pars...

CVE-2026-54427 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser

Uncontrolled recursion in the AMF parser in Apache bRPC 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected...

CVE-2026-54427

Apache bRPC versions prior to 1.18.0 are vulnerable to a stack exhaustion attack due to uncontrolled recursion in the AMF parser. The parser fails to enforce a depth limit when processing nested AMF containers, allowing a remote RTMP peer to crash the bRPC process by sending deeply nested AMF obj...

CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

CVE-2026-54425

Apache bRPC versions before 1.18.0 are vulnerable to a denial of service (DoS) attack due to uncontrolled recursion in the HTTP/2 HPACK decoder. A remote attacker can trigger this by sending a crafted HTTP/2 header block with numerous consecutive Dynamic Table Size Update entries. Because the dec...

Stack Exhaustion DoS

Neethi is vulnerable to Stack Exhaustion DoS. The vulnerability is due to bypassing Neethi's nesting-depth limit, where a specially crafted WS-Policy document with deeply nested policy elements can exhaust the thread stack and crash the parser, causing a denial of service...

CVE-2026-112062

A flaw was found in lwIP. An adjacent attacker on the local network can cause a Denial of Service DoS by sending specially crafted multicast Domain Name System mDNS responses with invalid domain names or record lengths. Processing these malformed packets during a service search triggers a...

CVE-2026-112063

A flaw was found in libstrophe. A malicious XMPP Extensible Messaging and Presence Protocol server can exploit a stack-based buffer overflow in the SCRAM Salted Challenge Response Authentication Mechanism authentication handler by sending an oversized salt value. This issue allows an attacker to...

CLSA-2026-1791858923 Fix of 174 CVEs

CVE-2026-90205 - ocfs2: validate orphan slot during inode read CVE-2026-90205 CVE-2026-93054 - uio: Fix stale info pointer in failed registration path CVE-2026-93054 CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure CVE-2026-93103 CVE-2026-89833 - f2fs: fix to avoid potential...

CVE-2026-98613

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service DoS by creating deeply nested or cyclical object references using local kernel pointers. During object cleanup, synchronous recursive...

Vulnerabilities in libxml2 (CVE-2026-86140 CVE-2026-86141 CVE-2026-86143 CVE-2026-86144) affect AIX

IBM SECURITY ADVISORY First Issued: Wed Oct 21 05:56:41 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/libxml2advisory12.asc Security Bulletin: Vulnerabilities in libxml2 CVE-2026-86140, CVE-2026-86141, CVE-2026-86143,...

CLSA-2026-1792562041 gstreamer1-plugins-bad-free: Fix of 2 CVEs

CVE-2026-3082: jpegparser: fix heap buffer overflow by checking the Huffman table length against its storage before copying it - CVE-2026-59692: dtls: fix stack buffer overflow by allocating the buffer for the peer certificate subject DN to its printed length...