18 matches found
CVE-2026-89651
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
EUVD-2026-66476
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...
CVE-2026-80561
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...
CVE-2026-80561
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...
CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...
CVE-2026-80561
CVE-2026-80561 is a critical (CVSS 9.8) vulnerability in the Linux kernel's libceph component. The decode_locker() function in cls_lock_client.c contains three unsafe decode operations with missing bounds checks, allowing a malicious or compromised OSD in a multi-tenant Ceph deployment to trigger...
CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...
Linux Distros Unpatched Vulnerability : CVE-2026-80561
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromis...
AZL-94643 CVE-2026-68082 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
UBUNTU-CVE-2026-68082
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...
CVE-2026-58186
The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...
CVE-2026-58186
CVE-2026-58186 affects Apache Traffic Server: the webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. Impacted versions: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 8.2.x/9.2.15 or 10.1.4+ fixes the issue (per the advisory). The CVSS metrics indicat...
CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...
CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...
PT-2026-65763
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description The webp transform plugin can decode data unsafely, leading to the delivery...
PYSEC-2026-1894 Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process...
EUVD-2025-206569
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process...
PT-2026-25910
Name of the Vulnerable Software and Affected Versions lz4 flex versions 0.11.5 and below and 0.12.0 Description lz4 flex, a Rust implementation of LZ4 compression/decompression, contains a flaw where decompressing invalid LZ4 data can lead to information disclosure. Specifically, the library does...