36 matches found
swift-crypto: swift-crypto: Denial of Service via unbounded input to the P-384 VOPRF API
A flaw was found in swift-crypto. A remote attacker can trigger a Denial of Service DoS by providing excessively long or unbounded input to an application utilizing the P-384 Verifiable Oblivious Pseudorandom Function VOPRF interface. Because the interface does not adequately restrict input lengt...
CVE-2026-86983
A flaw was found in swift-crypto. A remote attacker can trigger a Denial of Service DoS by providing excessively long or unbounded input to an application utilizing the P-384 Verifiable Oblivious Pseudorandom Function VOPRF interface. Because the interface does not adequately restrict input lengt...
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
CVE-2026-86983
The swift-crypto library is vulnerable to a denial-of-service condition where a remote attacker can terminate a process . The root cause is the lack of length bounding on attacker-controlled input passed to the P-384 VOPRF API . This vulnerability is addressed in swift-crypto version 5.0.3 . No s...
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
EUVD-2026-112556
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
Apple Swift Crypto security vulnerability
A security vulnerability exists in Apple Swift versions prior to 5.0.3. This vulnerability stems from the P-384 VOPRF API failing to restrict the length of input controlled by attackers, potentially allowing remote attackers to terminate processes...
PT-2026-129229
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
CVE-2026-86983: Apple swift-crypto: A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API…
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...
Amazon Linux 2023 : swiftlang, swiftlang-lib (ALAS2023-2026-2073)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2073 advisory. When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory...
Important: swiftlang
Issue Overview: When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from...
swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization
A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...
swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization
A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...
CVE-2026-43823
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
CVE-2026-43823
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
EUVD-2026-48288
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
CVE-2026-43823
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
CVE-2026-43823
A double-free vulnerability exists in swift-crypto (specifically within the swiftlang package) when initializing an RSA public key from DER or PEM formatted bytes. If BoringSSL fails to decode the provided bytes, the EVP_PKEY* is freed twice—once in the catch block and again during deinitializati...
CVE-2026-43823
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...