18717 matches found
AZL-105621 CVE-2026-54872 affecting package openvmm 0.1.0-1
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...
AZL-105858 CVE-2026-54872 affecting package rust 1.96.1-2
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn...
AZL-105624 CVE-2026-54875 affecting package openvmm 0.1.0-1
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...
AZL-105435 CVE-2026-54873 affecting package cloud-hypervisor 52.0.152-1
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105840 CVE-2026-54875 affecting package rust 1.75.0-31
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...
AZL-105453 CVE-2026-54875 affecting package cloud-hypervisor 52.0.152-1
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...
AZL-105606 CVE-2026-54873 affecting package openvmm 0.1.0-1
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105846 CVE-2026-54873 affecting package rust 1.75.0-31
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105495 CVE-2026-54873 affecting package kata-containers 4.1.0.kata0-1
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105888 CVE-2026-54875 affecting package rust 1.96.1-2
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...
AZL-105867 CVE-2026-54873 affecting package rust 1.96.1-2
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105582 CVE-2026-54875 affecting package openssl 3.3.7-6
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...
AZL-105576 CVE-2026-54873 affecting package openssl 3.3.7-6
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...
AZL-105513 CVE-2026-35189 affecting package kata-containers 4.1.0.kata0-1
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105627 CVE-2026-35189 affecting package openvmm 0.1.0-1
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105720 CVE-2026-35189 affecting package qemu 10.1.0-1
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105870 CVE-2026-35189 affecting package rust 1.96.1-2
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105564 CVE-2026-35189 affecting package openssl 3.3.7-6
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105900 CVE-2026-35189 affecting package shim-unsigned-aarch64 16.1-2
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105357 CVE-2026-35189 affecting package openssl-fips-provider 3.1.2-2
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105447 CVE-2026-35189 affecting package cloud-hypervisor 52.0.152-1
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105474 CVE-2026-35189 affecting package edk2 20240524git3e722403cd16-20
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105903 CVE-2026-35189 affecting package shim-unsigned-x64 16.1-2
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105819 CVE-2026-35189 affecting package rust 1.75.0-31
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...
AZL-105828 CVE-2026-42772 affecting package rust 1.75.0-31
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105876 CVE-2026-42772 affecting package rust 1.96.1-2
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105885 CVE-2026-35191 affecting package rust 1.96.1-2
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...
AZL-105531 CVE-2026-35191 affecting package kata-containers 4.1.0.kata0-1
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...
AZL-105525 CVE-2026-42772 affecting package kata-containers 4.1.0.kata0-1
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105837 CVE-2026-35191 affecting package rust 1.75.0-31
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...
AZL-105579 CVE-2026-42772 affecting package openssl 3.3.7-6
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105456 CVE-2026-42772 affecting package cloud-hypervisor 52.0.152-1
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105612 CVE-2026-35191 affecting package openvmm 0.1.0-1
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...
AZL-105462 CVE-2026-35191 affecting package cloud-hypervisor 52.0.152-1
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...
AZL-105630 CVE-2026-42772 affecting package openvmm 0.1.0-1
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...
AZL-105654 CVE-2026-102598 affecting package python-tensorboard 2.16.2-6
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...
AZL-105681 CVE-2026-102598 affecting package python-werkzeug 3.0.3-2
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...
AZL-105921 CVE-2026-102598 affecting package tensorflow 2.16.1-11
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...
AZL-105906 CVE-2026-63209 affecting package telegraf 1.31.0-33
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...
AZL-105534 CVE-2026-63209 affecting package keda 2.14.1-19
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...
AZL-105813 CVE-2026-95520 affecting package rpm 4.18.2-2
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAGLONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext that shrinks a buffer allocation to one byte, after which the payload's...
AZL-105003 CVE-2026-96423 affecting package wireshark 4.4.7-2
X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...
AZL-105024 CVE-2026-96422 affecting package wireshark 4.4.7-2
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...
AZL-105033 CVE-2026-96419 affecting package wireshark 4.4.7-2
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution...
AZL-105042 CVE-2026-96416 affecting package wireshark 4.4.7-2
IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...
AZL-105021 CVE-2026-96418 affecting package wireshark 4.4.7-2
TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...
AZL-105000 CVE-2026-96420 affecting package wireshark 4.4.7-2
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...
AZL-105036 CVE-2026-96417 affecting package wireshark 4.4.7-2
RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...