Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Reachable Assertion in the zlib params() Write Callback After Stream Destruction leading to an Uncatchable ERR_INTERNAL_ASSERTION Crash

Reachable Assertion in the zlib params Write Callback After Stream Destruction leading to an Uncatchable ERRINTERNALASSERTION Crash vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. However, since the addition of write fifo support, the keyspanpda implementation will...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

The netty-tcnative library before version 2.0.84.Final is vulnerable to a Denial of Service (DoS) flaw within the tcn_write_to_bytebuffer BIO write callback. The root cause is an incorrect calculation where the callback overreports the number of bytes consumed. This allow remote TLS 1.3 peers to ...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

PT-2026-123394

Content removed...

curl: CVE-2026-92388: FTP wildcard write callback mixup

Hi all, A failed FTP wildcard LIST leaves data-set.fwritefunc pointing at libcurl's internal listing parser and data-set.out pointing at the easy handle itself, because the code path that restores them is only reached on a successful listing. That alone is a crash on reuse. However,...

CVE-2026-86143

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

AZL-99705 CVE-2026-86143 affecting package libxml2 for versions less than 2.11.5-11

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

libxml2 before 2.15.4 has an integer overflow in the xmlIO module. An inconsistency between xmlOutputWriteCallback and xmlBufUse causes negative length values to reach downstream write callbacks when data backlogs exceed maximum integer limits (approximately 2 GiB ). This can lead to data corrupt...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

EUVD-2026-71822

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

PT-2026-86304

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description An inconsistency between xmlOutputWriteCallback and xmlBufUse in the xmlIO component allows negative lengths to reach write callbacks due to a missing integer overflow check before the writecallback...

CVE-2026-64336

A flaw was found in the Linux kernel's keyspanpda USB serial driver. An issue with the write callback function allows it to report more data written than was actually provided. This can lead to the system writing data beyond its allocated buffer, resulting in an information leak. A local attacker...

CVE-2026-64336

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...