5346 matches found
CVE-2026-88045
rclone (a CLI for syncing files across cloud storage) is affected by a memory exhaustion vulnerability in its S3 multipart streaming path (cmd/serve/s3/multipart.go). From v1.75.0 through v1.75.1 , an attacker-controlled Content-Length is passed to multipart.NewRW().Reserve before the request bod...
GHSA-Q5J5-6P94-4GWC Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Streaming GetRows row-bound bypass causes attacker-controlled allocation Summary Excelize's prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by Rows and GetRows does not enforce the same TotalRows bound on the row r...
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Streaming GetRows row-bound bypass causes attacker-controlled allocation Summary Excelize's prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by Rows and GetRows does not enforce the same TotalRows bound on the row r...
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
SummaryWhen decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respons...
PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...
CVE-2026-42808
An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...
CVE-2026-42808
An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...
CVE-2026-42808
An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...
EUVD-2026-75364
An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...
CVE-2026-38998
A flaw was found in LIVE555 Streaming Media. This use-after-free vulnerability allows a remote attacker to cause a Denial of Service DoS. By sending a series of specially crafted Real-Time Streaming Protocol RTSP and Hypertext Transfer Protocol HTTP requests, an attacker can trigger the flaw,...
PocketCinema
PocketCinema for Miyoo Mini Plus A lightweight Stremio-style...
CLEANSTART-2026-FD87409 Previously, resolving relative paths containing parent directory ('
Multiple security vulnerabilities affect the nats-streaming package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-UN51807 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the nats-streaming package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
PT-2026-89335
An issue was discovered in Bosch Sensortec COINES SDK versions 2.0 through 2.11. The host streaming API function coines read stream sensor data fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in comm intf process stream...
DEBIAN-CVE-2026-38998
A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...
CVE-2026-38998
A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...
UBUNTU-CVE-2026-38998
A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...
htb-recon-web
htb-recon A web dashboard that runs a full enumeration pipe...
CVE-2026-38998: Use After Free
A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...