CVE-2026-81535 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

CVE-2026-81535

The wolfSSH SSH client (versions through 1.5.0 built with --enable-fwd) is vulnerable to an authorization bypass in the DoChannelOpen() function located in src/internal.c. The software only validates direct-tcpip channel opens against the forwarding policy, while forwarded-tcpip opens are admitte...

CVE-2026-85442 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten, allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory an...

PT-2026-85291

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description An issue exists where the software fails to validate packet length declarations in the CMOOSCommPkt::OnBytesWritten function. This allows unauthenticated attackers to trigger unbounded buffer...

CVE-2026-85442: Memory Allocation with Excessive Size Value

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten, allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory an...