107100 matches found
CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...
CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...
EUVD-2026-103577
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...
dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...
EUVD-2026-103696
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...
CVE-2026-98456
A race condition in the Linux kernel's Bluetooth subsystem within the read_unconf_index_list() function allows for a local privilege escalation or Denial of Service (DoS) . The flaw occurs because hci_dev_list_lock stabilizes list membership but fails to serialize per-device flags. During asynchr...
CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...
CVE-2026-98456 Bluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...
DEBIAN-CVE-2026-112062
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
DEBIAN-CVE-2026-112060
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...
CVE-2026-112059
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...
CVE-2026-112062
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
CVE-2026-112060
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...
CVE-2026-112051
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...
UBUNTU-CVE-2026-112062
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
CVE-2026-112059
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...
CVE-2026-112062
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers...
CVE-2026-112062
The lwIP network stack (versions through 2.2.1 ) is vulnerable to a stack out-of-bounds write in the mdns_handle_response function. An adjacent attacker on the local link can exploit this by sending specially crafted mDNS responses during a service search—specifically, multicast PTR answers with ...