Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Buffer validation was corrected by including the size of the null-terminating character in the EA length. The smb2setea function, which handles Extended Attributes EA, conducted buffer validation checks that incorrectly...

Imperva Customers Protected Against Novel HTTP Desync Attacks

TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

EUVD-2026-52447

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes ...

PT-2026-67524

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response json cb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When t...

Oracle Linux 10 : openssh (ELSA-2026-47757)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47757 advisory. - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed in unintended parent directories when scp performs remote-to-remote copy...

openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI Generic Security Service Application Programming Interface indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific...

Security update for glib2

This update for glib2 fixes the following issues: CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. CVE-2026-58012: raw...

UBUNTU-CVE-2026-64411

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

CVE-2026-63860

A flaw was found in the Linux kernel's RDMA/core component. This vulnerability arises from the improper handling of Netlink Attribute NLA strings, where attributes evaluated as C-strings do not properly check for a null terminator. A local attacker could potentially provide specially crafted inpu...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

CVE-2026-26199

The CVE-2026-26199 entry describes a buffer underflow in HDF5 when calling H5Iget_name (and H5G_get_name) with a size of zero. Under conditions where an ID is queried with size forced to zero and there is significant data before the name buffer, the function may fail to place a null terminator, l...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

EUVD-2026-45970

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

PT-2026-61600

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Iget name is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Iget name is invoked in a way...

CVE-2024-58364

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing...

EUVD-2024-55680

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing...

CVE-2024-58364

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing...