CGI: Denial of Service in CGI::Cookie.parse

A flaw was found in Ruby's CGI gem. Processing specially crafted large cookies with the CGI::Cookie.parse method can cause excessive resource consumption due to a missing limit on the length of the raw cookie value, resulting in a denial of service...

quickjs:fuzz_eval: Use-of-uninitialized-value in JS_FreeRuntime

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=6556534329114624 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzeval Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type:...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21922)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21922 advisory. - In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning wit...

matio:matio_fuzzer: Use-of-uninitialized-value in Mat_PrintNumber

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=5137924817747968 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzermsanmatio Platform Id: linux Crash Type: Use-of-uninitialized-val...

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

...

ppp: Fix KMSAN uninit-value warning with bpf

...

Citrix DaaS: Get-BrokerApplication - Invalid enum value 'PackagedApplication'

Get-BrokerApplication cmdlet fails with exception when running on the machine with Remote SDK installed. Exception details: The formatter threw an exception while trying to deserialize the message: There was an error while trying to deserialize parameter http://tempuri.org/:records. The...

libxml2 Python API DoS

The vulnerability of the Python API component of the libxml2 library is related to incorrect checking of the returned value from methods or functions. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

GPAC multimedia platform DoS

The vulnerability of the multimedia platform GPAC is related to an unverified return value. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2025-4166

Vault Community and Vault Enterprise Key/Value kv Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is...

llvm:llvm-opt-fuzzer--x86_64-loop_predication: Use-of-uninitialized-value in llvm::SlotTracker::processFunction

Detailed Report: https://oss-fuzz.com/testcase?key=4751128082579456 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-opt-fuzzer--x8664-looppredication Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

OSV-2025-321 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=415088961 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

PT-2025-20242 · Git +1 · Quickjs

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue involves a use-of-uninitialized-value crash occurring within the JS DefineProperty function, triggered through JS CallInternal and build backtrace...

SUSE CVE-2023-53077

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes WHY When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dmllog2 returns an unexpected negative value: shift exponent 4294966273 is t...

[SECURITY] Fedora 42 Update: valkey-8.0.3-1.fc42

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 41 Update: valkey-8.0.3-1.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 40 Update: valkey-8.0.3-1.fc40

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 40 Update: redis-7.2.8-1.fc40

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

DEBIAN-CVE-2023-53080

In the Linux kernel, the following vulnerability has been resolved: xsk: Add missing overflow check in xdpumemreg The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem-npgs...

CVE-2023-53093

CVE-2023-53093 affects the Linux kernel tracing subsystem, where histogram values are not allowed to use certain modifiers. The root cause is that histogram code was not prepared to handle modifiers for histograms, leading to a NULL pointer dereference and kernel oops when printing histograms via...