CVE-2026-100354

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

EUVD-2026-102162

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

FreeRDP buffer error vulnerability

Versions of FreeRDP from 3.30.0 to 3.32.0 contain a buffer error vulnerability. This vulnerability stems from improper handling of clipboard responses by the Windows client’s CliprdrStreamNew function. It involves a stack out-of-bounds read issue, allowing malicious RDP servers to trigger invalid...

R. S. Doiel antiword buffer error vulnerability

R. S. Doiel’s Antiword versions 0.37 and earlier have a buffer error vulnerability. This vulnerability stems from the fact that vGet8PapInfo and vGet8ChrInfo in prop8.c do not perform boundary checks on the FKP run count and grpprl offset. As a result, stack overflow occurs, allowing attackers to...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: Fixed a stack overflow issue when LRO is disabled for virtual interfaces. When the features of a virtual interface are updated, the updated features are synchronized with its underlying interfaces. This synchronization...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: uinput – Zero initializes uinputff UploadCompat to prevent information leakage. The struct ffeffectcompat is embedded twice within uinputff UploadCompat and contains internal padding. In particular, there is a gap after...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fixed the race involving destroyworkonstack. The following debug object splat was observed during testing: ODEBUG: Freeing an active object active state 0: 0000000097d23782; Object type: workstruct; Hint:...

Astra Linux – vulnerability in Chromium

A stack buffer overflow in V8 within Google Chrome prior to version 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in jq

jq is a command-line JSON processor. In versions 1.8.1 and earlier, the functions jvsetpath, jvgetpath, and delpathssorted in jq’s src/jvaux.c utilize unbounded recursion; the recursion depth is determined solely by the length of an array passed as a path argument by the caller, with no depth lim...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a potential security issue involving infinite recursion in the MSL Magick Scripting Language command when writing to MSL format. Version 7.1.2-13 addresses this issue...

Astra Linux – Vulnerability in busybox

There is a stack overflow vulnerability in ash.c:6030 in busybox before version 1.35. In the environment of the Internet of Vehicles, this vulnerability can lead to the execution of arbitrary code from commands...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside the top interrupt context as uninteresting or irrelevant parts of the stack traces. This aids in stack trace de-duplication,...

Astra Linux – vulnerability in golang-1.19

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A NULL pointer dereference flaw was discovered in the Linux kernel’s ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile. However, this assumption does not always hold if the skb is rerouted by ipvs. This issue may allow a local user with...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmfcpreinitdcmds This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep in...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite reads message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: The PMK parameter is now passed as binary data, rather than hexadecimal data. It appears that the hexadecimal passphrase mechanism does not work on newer chips/firmwares e.g., BCM4387. There was actually...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added a depth limit to indxfindbuffer to prevent stack overflow. indxfindbuffer recursively descends the B+ tree index without a depth limit. A malicious NTFS image with circular index node references causes unbounded...