CVE-2026-104016

The jackson-dataformat-protobuf library is vulnerable to a signed integer overflow within the ProtobufParser component when processing length-prefixed protobuf string and bytes fields. Specifically, when an attacker provides a varint decoding with a length near Integer.MAX_VALUE , the arithmetic ...

Ubuntu 24.04 LTS / 26.04 LTS : Protocol Buffers vulnerability (USN-8943-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8943-1 advisory. It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP...

USN-8943-1 protobuf vulnerability

It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of...

USN-8943-1: Protocol Buffers vulnerability

It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of...

BIT-HAPROXY-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...

CVE-2026-26080

A flaw was found in HAProxy. An attacker can exploit a vulnerability where the software mishandles varint variable-length integer encoding. This can cause HAProxy to enter an infinite loop or crash, leading to a denial of service for affected systems. Mitigation No mitigation is required. No Red...

CVE-2026-61799

"io.netty.incubator:netty-incubator-codec-bhttp" uses attacker-controlled Binary HTTP variable-length integers as "long" values but accumulates them into "int" offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked "ArrayIndexOutOfBoundsException" /...

PT-2026-80297

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readOpaque method of MLSInputStream, which decodes a varint length up to 0x3FFFFFFF about 1 GiB and calls readAllsize performing new bytesize before checking that enough bytes remain in...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readOpaque method of MLSInputStream, which decodes a varint length up to 0x3FFFFFFF about 1 GiB and calls readAllsize performing new bytesize before checking that enough bytes remain in...

NewStart CGSL MAIN 6.06 : docker-image-check Multiple Vulnerabilities (NS-SA-2026-0055)

The remote NewStart CGSL host, running version MAIN 6.06, has docker-image-check packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications...

BIT-THRIFT-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Infinite loop

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes...

Infinite loop

Overview ApacheThrift is a Thrift client library for Microsoft .NET Standard Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing...

Infinite loop

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by sending a TCompactProtocol varint whose continuation b...

Infinite loop

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by...

Infinite loop

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang t...

Infinite loop

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by sending a...