CVE-2026-123616

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the datasize field. Attackers can supply a crafted 23-byte ICO file declaring a 4GB datasize to trigger memory exhaustion and worker crashes without authentication...

EUVD-2026-119375

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the datasize field. Attackers can supply a crafted 23-byte ICO file declaring a 4GB datasize to trigger memory exhaustion and worker crashes without authentication...

PT-2026-139897

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data size field. Attackers can supply a crafted 23-byte ICO file declaring a 4GB data size to trigger memory exhaustion and worker crashes without authentication...

CVE-2026-123616: imgproxy: imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to…

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the datasize field. Attackers can supply a crafted 23-byte ICO file declaring a 4GB datasize to trigger memory exhaustion and worker crashes without authentication...

Daryll Doyle svg-sanitizer improper exception handling vulnerability

In Daryll Doyle’s svg-sanitizer versions from 0.11.0 up to but including 1.1.0, there is an improper exception handling vulnerability. This stems from unhandled exceptions: when an attacker submits a well-formatted XML lacking a top-level svg root, or documents containing non-svg-root elements an...

CLSA-2026-1791276939 Fix CVE(s): CVE-2026-42533

SECURITY UPDATE: heap buffer overflow in the script engine when a map regex capture or a non-cacheable variable changes length between the length and copy passes of a string expression - debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the acces...

CVE-2026-69147

A flaw was found in vLLM, an inference and serving engine for large language models. An attacker can exploit this by submitting specially crafted video requests that force the use of the PyNvVideoCodec GPU decoder. This bypasses the engine's static GPU memory reservation, allowing the attacker to...

haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions

A flaw was found in HAProxy. An attacker can trigger HPACK dynamic table insertions under memory pressure, leading to a null pointer dereference in the hpackdhtinsert function. This can cause HAProxy worker processes to crash, resulting in a denial of service DoS...

CVE-2026-48090

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter envoy.filters.http.oauth2 can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late...

CVE-2026-48090: Use After Free

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter envoy.filters.http.oauth2 can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late...

CVE-2026-26209

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the...

Security update for nginx

This update for nginx fixes the following issues: CVE-2023-44487: Mitigate HTTP/2 Rapid Reset Attack bsc1216171 CVE-2024-7347: Fixed worker crashes on special crafted mp4 files containing invalid chunk information bsc1229155 Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2025:0283-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2023-44487: Mitigate HTTP/2 Rapid Reset Attack bsc1216171 - CVE-2024-7347: Fixed worker crashes on special crafted mp4 files containing invalid chunk information bsc1229155...

Security update for nginx

This update for nginx fixes the following issues: CVE-2023-44487: Mitigate HTTP/2 Rapid Reset Attack bsc1216171 CVE-2024-7347: Fixed worker crashes on special crafted mp4 files containing invalid chunk information bsc1229155 Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2025:0282-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2023-44487: Mitigate HTTP/2 Rapid Reset Attack bsc1216171 - CVE-2024-7347: Fixed worker crashes on special crafted mp4 files containing invalid chunk information bsc1229155...

SUSE SLES15 Security Update : nginx (SUSE-SU-2025:0282-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0282-1 advisory. - CVE-2023-44487: Mitigate HTTP/2 Rapid Reset Attack bsc1216171 - CVE-2024-7347: Fixed worker crashes on special crafted mp4 files...

DEBIAN-CVE-2024-32760

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact...