16237 matches found
netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message
A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...
wabt:read_binary_ir_fuzzer: Use-of-uninitialized-value in wabt::SharedValidator::OnRefFunc
Detailed Report: https://oss-fuzz.com/testcase?key=4856820724989952 Project: wabt Fuzzing Engine: libFuzzer Fuzz Target: readbinaryirfuzzer Job Type: libfuzzermsanwabt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: wabt::SharedValidator::OnRefFunc...
CVE-2026-55199
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...
CVE-2026-55199
CVE-2026-55199 affects libssh2 up to version 1.11.1. The vulnerability lies in the SSH_MSG_EXT_INFO handler (src/packet.c), where return values from _libssh2_get_string() are unchecked. During key exchange, a malicious SSH server can set nr_extensions to 0xFFFFFFFF, causing the client to spin in ...
UBUNTU-CVE-2026-11525
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example,...
CVE-2026-11525
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example,...
netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers
A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...
CVE-2026-0082
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
assimp:assimp_fuzzer: Use-of-uninitialized-value in Assimp::LWOImporter::CopyFaceIndicesLWO2
Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5264547070672896 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzermsanassimp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
CVE-2026-46286
A flaw was found in the Linux kernel's qcom-lpg LED driver. This vulnerability, an array overflow, occurs when the driver attempts to select high-resolution values. Due to incorrect indexing, the system may read random data from memory, which could lead to information disclosure or unpredictable...
SUSE CVE-2026-29181
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines...
GHSA-WGPF-JWQJ-8H8P hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Summary On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated reques...
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Summary On AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated reques...
ROS-20260616-73-0016
The vulnerability in ImageMagick is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...
ROS-20260616-73-0017
The vulnerability in ImageMagick 7 is related to an unvalidated returned value. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2026-49736
Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.25 Description On AWS Lambda@Edge, CloudFront delivers request headers that appear multiple times as separate entries. The adapter uses the Headers.set function instead of Headers.append, causing each subsequent val...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-boot-3.5.13.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-40973, CVE-2026-40975, CVE-2026-40977. Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...
SUSE-SU-2026:22103-1 Security update for opensc
This update for opensc fixes the following issues - CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation bsc1267246. - CVE-2026-40528: stack and heap buffer overrun in the dokeyvalue function due to missing length check allows for memory corrupti...
libssh: Incorrect Return Code Handling in ssh_kdf() in libssh
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...
