82 matches found
EUVD-2026-112224
An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length...
CVE-2026-103392
The Juniper Networks Session Smart Router is vulnerable to an Out-of-Bounds Write in its TCP header processing. An attacker can exploit this by sending a transit TCP packet with an oversized SACK option length , which allows for the corruption of TCP payload data and potential session desynchroni...
CVE-2026-80875
A flaw was found in the IP Virtual Server IPVS component of the Linux kernel. When processing IPv6 packets with extension headers, the TCP state handling incorrectly parses the TCP header by using a fixed size for the IPv6 header instead of the actual transport-header offset. This can cause the...
Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45843)
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode reads against the compressed packet length slhcuncompress parses a VJ-compressed TCP header by advancing a pointer through the packet via decode and pull16. Neither helper bounds-checks against isize, and decod...
Linux Kernel Security Vulnerabilities
The Linux kernel version 7.1 contains a security vulnerability. This vulnerability stems from the use of the TCP header length incorrectly in UDP GSO packets by the gvecansendtso function. This leads to an incorrect estimation of the number of segmentation buffers, potentially causing unnecessary...
Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfrejectipv6: fix nfrejectip6tcphdrput SyZBot reported that nfrejectip6tcphdrput might be sending garbage to the four reserved TCP bits th-res1. Use skbputzero to clear the entire TCP header, as done in...
CVE-2026-68119
A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. When the kernel constructs standalone TCP responses with TCP-AO options, padding bytes in the TCP header may be left uninitialized. If the Message Authentication Code MAC length is not four-byte aligned, these...
SUSE CVE-2026-64007
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...
SUSE-SU-2026:3133-1 Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. - CVE-2026-52720: inval...
CVE-2026-64007
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...
EUVD-2026-45580
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...
CVE-2026-64007 netfilter: synproxy: refresh tcphdr after skb_ensure_writable
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...
CVE-2026-64007
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...
CVE-2026-52721 Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could...
PT-2026-49337
Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description Multiple out-of-bounds read issues exist in the pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during the parsing of IPv4 and TCP headers. A local...
CVE-2026-52721: Out-of-bounds Read
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing. This element is primarily used in debugging pipelines, limiting real-world exposure. A local attacker could...
CVE-2026-45843
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode reads against the compressed packet length slhcuncompress parses a VJ-compressed TCP header by advancing a pointer through the packet via decode and pull16. Neither helper bounds-checks against isize, and decod...
CVE-2026-45843 slip: bound decode() reads against the compressed packet length
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode reads against the compressed packet length slhcuncompress parses a VJ-compressed TCP header by advancing a pointer through the packet via decode and pull16. Neither helper bounds-checks against isize, and decod...
CVE-2026-45843: Buffer Over-read
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode reads against the compressed packet length slhcuncompress parses a VJ-compressed TCP header by advancing a pointer through the packet via decode and pull16. Neither helper bounds-checks against isize, and decod...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005123)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005123 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfrejectipv6: fix nfrejectip6tcphdrput syzbot reported that nfrejectip6tcphdrput was...