CVE-2026-73141

A flaw was found in svxlink's audio decoders. A variable-length array on the stack is sized using an attacker-controlled encoded-frame length field received over the network. By sending a frame with an excessively large length value, a remote attacker can exhaust the stack, resulting in a denial ...

CVE-2026-73153

A flaw was found in svxlink's EchoLink implementation. An out-of-bounds read in the RTCP/SDES packet handling allows a pre-authentication remote attacker to read beyond buffer boundaries via crafted UDP packets, potentially leading to information disclosure or a crash. Mitigation Update svxlink t...

CVE-2026-73154

A flaw was found in svxlink. A stack overflow in the StationData::setData function can be triggered by specially crafted input data, potentially allowing a remote attacker to crash the application or achieve arbitrary code execution. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73152

A flaw was found in svxlink's EchoLink proxy implementation. An integer truncation in message-length handling can result in incorrect buffer sizes, leading to potential memory corruption when processing specially crafted proxy messages. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73151

A flaw was found in svxlink's remotetrx NetUplink component. An unvalidated audio length field enables an out-of-bounds read, and when AUTHKEY is not set, transceiver control functions are exposed to unauthenticated remote access. This allows unauthorized control of radio hardware connected to th...

CVE-2026-73150

A flaw was found in svxlink's LocationInfo/APRS functionality. The updateQsoStatus function in AprsTcpClient.cpp formats a remote EchoLink station's callsign and info string into a fixed 80-byte stack buffer using sprintf without length checks. A remote attacker controlling an EchoLink station ca...

CVE-2026-73149

A flaw was found in svxlink's NetRx component. An unvalidated MsgAudio length field allows a remote attacker to trigger an out-of-bounds read beyond buffer boundaries, potentially leading to information disclosure or a crash. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73147

A flaw was found in svxlink's reflector client. The talkerstart and talkerstop event handlers directly concatenate a server-supplied talker callsign into TclEval commands without any sanitization or escaping. A malicious or compromised reflector server can supply a crafted callsign containing TCL...

CVE-2026-73146

A flaw was found in svxlink's svxreflector component. A reentrant client deletion triggered via a sendError write-failure path leads to a use-after-free on the client object. A remote attacker can trigger this condition to crash the reflector server or potentially achieve arbitrary code execution...

CVE-2026-73145

A flaw was found in svxlink's asynchronous HTTP server. No limits are enforced on incoming HTTP request-line or header sizes. A remote attacker can send excessively large requests to exhaust available memory, resulting in a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73144

A flaw was found in svxlink's FRN module. A server-supplied list item count is accepted without validation, allowing a malicious server to trigger unbounded memory allocation. This can lead to memory exhaustion and a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73143

A flaw was found in svxlink's RtlTcp component. A malformed rtltcp greeting from a remote source triggers an unconditional exit1 call, causing the entire svxlink daemon to terminate. A remote attacker can exploit this to achieve a complete denial of service of the repeater controller. Mitigation...

CVE-2026-73142

A flaw was found in svxlink's remotetrx NetUplink component. When a server initiates a disconnect, the associated connection object is not properly freed, causing a memory leak. A remote attacker can repeatedly trigger disconnects to cause unbounded memory growth, leading to a denial of service...