5981 matches found
PT-2026-82724
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...
CVE-2026-26456
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...
CVE-2026-47851
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: thrift (UTSA-2026-032285)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032285 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gssproxy (UTSA-2026-093183)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093183 advisory. gssproxy aka gss-proxy before 0.8.3 does not unlock condmutex before pthread exit in gpworkermain in gpworkers.c. NOTE: An upstream comment states We are already on ...
CVE-2026-77357
Mesop is a Python-based UI framework for building web applications. Prior to 1.3.3 , applications running in debug mode expose a GET /hot-reload endpoint containing an unbounded loop that depends on a user-supplied counter parameter. An unauthenticated attacker can send a request with a high coun...
CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...
CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...
BIT-KEYCLOAK-2026-7307 Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...
CVE-2026-13214 Stack buffer overflow in OCPP GetConfiguration key parsing
The OCPP 1.6 client in subsys/net/lib/ocpp/ocppj.c contains a stack buffer overflow in parsegetconfigmsg. When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer skeyCISTR50, declar...
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime...
CVE-2025-36939
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...
CVE-2025-36939
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...
CVE-2025-36939
Multiple vulnerabilities exist in OpenThread 's handling of MLE (Mesh Link Establishment) packets . An authenticated attacker on the same Thread network can send specially crafted packets to trigger assertion failures and a stack-based buffer overflow , resulting in a denial of service . The CNA-...
CVE-2025-36939
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...
EUVD-2025-210766
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: dm: Avoid leaking the caller’s thread keyring via the table device file. The refactoring in commit a28d893eb327 “md: port block device access to file” accidentally causes the caller’s thread keyring to remain alive beyond the...
Linux driver/nvme/target/tcp.c DoS
The vulnerability in the drivers/nvme/target/tcp.c component of the Linux kernel is related to errors during thread blocking. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
Linux RDMA/mlx5 DoS
The vulnerability of the RDMA/mlx5 component of the Linux operating system is related to errors during thread locking. Exploiting this vulnerability can allow an attacker to cause a service failure...
