78063 matches found
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
SUSE CVE-2026-73070
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...
EUVD-2026-58509
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
EUVD-2026-58508
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an...
PT-2026-71970
Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description A remote attack is possible due to a stack-based buffer overflow in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file of the firewall.so component. This issue occurs when...
Linux Distros Unpatched Vulnerability : CVE-2026-56859
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56859 Note that Nessus relies on...
Linux Distros Unpatched Vulnerability : CVE-2026-33818
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 Note that Nessus relies on t...
PT-2026-72071
Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description A stack-based buffer overflow occurs when manipulating the pin argument within the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi endpoint, located in the wps.so component. This...
PT-2026-71955
Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23 multi TD01 Description A stack-based buffer overflow exists in the httpd web management interface. The issue occurs within the set device name function located in the '/goform/SetOnlineDevName' endpoint when th...
Linux Distros Unpatched Vulnerability : CVE-2026-73566
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an...
Linux Distros Unpatched Vulnerability : CVE-2026-19617
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could...
DEBIAN-CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
AZL-96641 CVE-2026-56859 affecting package golang 1.25.12-1
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
AZL-96677 CVE-2026-56859 affecting package golang 1.26.5-2
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...