Lucene search
+L

3541 matches found

RedHat Linux
RedHat Linux
added 2026/04/16 8:52 p.m.3 views

jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow

A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized...

8.2CVSS7.2AI score0.00484EPSS
SaveExploits1References6
Tenable Nessus
Tenable Nessus
added 2026/04/15 12:0 a.m.12 views

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2026:1325-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1325-1 advisory. Update to clamav 1.5.2: Security issue: - CVE-2026-20031: improper error handling in the HTML CSS module...

5.3CVSS5.9AI score0.00414EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/04/14 11:40 p.m.12 views

EUVD-2026-22243

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing...

7.4CVSS5.8AI score0.01085EPSS
SaveExploits1References4
Github Security Blog
Github Security Blog
added 2026/04/14 11:40 p.m.12 views

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Description as reported Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Background This vulnerability is a new variant discovered while researching the "Funky Chunks" HTTP request smuggling techniques: -...

9.1CVSS5.9AI score0.01085EPSS
SaveExploits1References5Affected Software1
RedHat Linux
RedHat Linux
added 2026/04/14 5:20 p.m.9 views

io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

7.5CVSS5.8AI score0.0064EPSS
SaveExploits1References8
NVD
NVD
added 2026/04/14 12:16 p.m.10 views

CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

9.1CVSS0.01085EPSS
SaveExploits1References12
UbuntuCve
UbuntuCve
added 2026/04/14 12:16 p.m.8 views

CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

9.1CVSS5.8AI score0.01085EPSS
SaveExploits1References3
OSV
OSV
added 2026/04/14 12:16 p.m.8 views

UBUNTU-CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

9.1CVSS5.8AI score0.01085EPSS
SaveExploits1References4
Vulnrichment
Vulnrichment
added 2026/04/14 10:59 a.m.2 views

CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

7.4CVSS5.8AI score0.01085EPSS
SaveExploits1References2
CVE
CVE
added 2026/04/14 10:59 a.m.370 views

CVE-2026-2332

In the provided records, CVE-2026-2332 is a Jetty HTTP/1.1 parser vulnerability allowing request smuggling via chunked extension quoted-strings. The issue arises when chunk extensions are parsed and a CRLF occurs inside quotes, enabling a smuggled request across requests on a single connection. D...

9.1CVSS5.8AI score0.01085EPSS
SaveExploits1References12Affected Software1
Cvelist
Cvelist
added 2026/04/14 10:59 a.m.67 views

CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

7.4CVSS0.01085EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/04/14 10:59 a.m.6 views

CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

7.4CVSS5.8AI score0.01085EPSS
SaveExploits1References3Affected Software1
Amazon
Amazon
added 2026/04/14 12:0 a.m.19 views

Medium: rust

Issue Overview: A flaw in the gix-date library can generate invalid non-UTF8 strings, leading to undefined behavior when processed. The most likely impact from a successful attack is to data integrity, by the malicious data being able to corrupt data being hold in memory and to system availabilit...

8.1CVSS5.9AI score0.00677EPSS
SaveExploits4
EUVD
EUVD
added 2026/04/13 10:10 p.m.5 views

EUVD-2026-22126

jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the strindices builtin in jq's src/builtin.c passes its arguments directly to jvstringindexes without verifying they are strings, and jvstringindexes in src/jv.c relies solely on assert checks that are...

6.1CVSS5.8AI score0.00174EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
added 2026/04/13 6:16 p.m.9 views

CVE-2026-32316

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvpstringappend and jvpstringcopyreplacebad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer...

8.2CVSS6AI score0.00484EPSS
SaveExploits1References5
AlpineLinux
AlpineLinux
added 2026/04/13 5:49 p.m.7 views

CVE-2026-32316

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvpstringappend and jvpstringcopyreplacebad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer...

8.2CVSS6AI score0.00484EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/04/13 5:49 p.m.4 views

EUVD-2026-22039

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvpstringappend and jvpstringcopyreplacebad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer...

8.2CVSS6.1AI score0.00484EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/04/13 5:49 p.m.38 views

CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvpstringappend and jvpstringcopyreplacebad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer...

8.2CVSS0.00484EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/04/13 5:49 p.m.13 views

CVE-2026-32316

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvpstringappend and jvpstringcopyreplacebad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer...

8.2CVSS6.1AI score0.00484EPSS
SaveExploits1References3
RedHat Linux
RedHat Linux
added 2026/04/13 3:0 a.m.19 views

nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions

A flaw was found in V8's string hashing mechanism within Node.js. A remote attacker can exploit this vulnerability by crafting requests containing integer-like strings. These specially crafted strings cause predictable hash collisions in V8's internal string table, particularly when processed by...

5.9CVSS6.6AI score0.00283EPSS
SaveExploits0References5
Rows per page
Query Builder