28854 matches found
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
...
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
...
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
...
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
...
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
...
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
...
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
...
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
...
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
...
net: lan743x: fix RX checksum use-after-free
...
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
...
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
...
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
...
selinux: preserve user SID across nested backing files
...
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
...
net: bridge: mst: move switchdev call outside rcu
...
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
...
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
...
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
...
ALSA: core: Fix potential UAF after asynchronous card release
...
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
...
wifi: cfg80211: ibss: ref BSS entry for joined event
...
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
...
wifi: mac80211: only operate on TDLS peers in the TDLS code
...
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
...
dmaengine: Fix device kref underflow in dma_chan_put()
...
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
...
wifi: mac80211: mesh: reset the CSA state when leaving
...
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
...
mmc: mxcmmc: cancel data work and watchdog on remove
...
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
...
btrfs: handle lack of space when cleaning up verity items
...
Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
...
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
...
Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match
...
af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
...
Apache Thrift: c_glib `read_all` spins when the underlying read returns 0
...
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
...
Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
...
wifi: cfg80211: don't free driver-owned scan requests
...
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
...
net/packet: clear RX owner on VNET header error
...
Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame
...
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
...
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
...
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
...
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
...
Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
...