Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bcache: Fixed the abuse of variable-length arrays in btreeiter. btreeiter is used in two ways: either allocated on the stack with a fixed size MAXBSETS, or from a mempool with a dynamic size based on the specific cache set...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Use variable length arrays instead of fixed-size ones. The issue with the “smatch warning” should be fixed: Error in ntfssetlabel: builtinmemcpy’s ‘uni-name’ is too small 20 vs 256...

CVE-2026-19023

A flaw was found in HDF5. The h5dump tool, used for dumping HDF5 file contents, is vulnerable to an untrusted pointer dereference. An attacker could craft a malicious HDF5 file containing a variable-length string dataset. When this file is processed in binary output mode, it can lead to a denial ...

CVE-2026-79902

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098824 advisory. In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btreeiter btreeiter is used in two ways: either...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

JLSEC-2026-1386

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

PT-2026-85164

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

GHSA-HMQ9-67W8-J5PW netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

PT-2026-80279

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

CVE-2026-74339

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...

CVE-2026-73141

A flaw was found in svxlink's audio decoders. A variable-length array on the stack is sized using an attacker-controlled encoded-frame length field received over the network. By sending a frame with an excessively large length value, a remote attacker can exhaust the stack, resulting in a denial ...

EUVD-2026-53659

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

UBUNTU-CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...