18717 matches found
AZL-94535 CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
AZL-94520 CVE-2026-14257 affecting package js-jquery 3.5.0-4
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
AZL-94116 CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
AZL-93050 CVE-2026-64600 affecting package kernel for versions less than 6.6.145.2-1
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfsreflinkfillcowhole,delalloc are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a...
AZL-93270 CVE-2026-6390 affecting package nano 6.4-3
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...
AZL-93303 CVE-2026-16615 affecting package rest for versions less than 0.9.0-2
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
AZL-93117 CVE-2026-13204 affecting package bind for versions less than 9.20.26-1
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through...
AZL-93123 CVE-2026-13321 affecting package bind for versions less than 9.20.26-1
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1...
AZL-93132 CVE-2026-11721 affecting package bind for versions less than 9.20.26-1
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...
AZL-93120 CVE-2026-10723 affecting package bind for versions less than 9.20.26-1
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through...
AZL-93126 CVE-2026-11605 affecting package bind for versions less than 9.20.26-1
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to...
AZL-93114 CVE-2026-10822 affecting package bind for versions less than 9.20.26-1
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...
AZL-93138 CVE-2026-12617 affecting package bind for versions less than 9.20.26-1
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A...
AZL-93129 CVE-2026-11331 affecting package bind for versions less than 9.20.26-1
An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of...
AZL-93135 CVE-2026-11622 affecting package bind for versions less than 9.20.26-1
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...
AZL-92955 CVE-2026-56444 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...
AZL-92940 CVE-2026-56416 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dnamevaliddatstart, ...' and passes it straight to 'querydnametolower'...
AZL-92958 CVE-2026-54478 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...
AZL-92946 CVE-2026-55717 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...
AZL-92919 CVE-2026-55973 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...
AZL-92976 CVE-2026-55991 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...
AZL-92934 CVE-2026-55708 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...
AZL-92973 CVE-2026-55990 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...
AZL-92979 CVE-2026-50251 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...
AZL-92928 CVE-2026-50248 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...
AZL-92970 CVE-2026-50046 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...
AZL-92988 CVE-2026-50243 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...
AZL-92937 CVE-2026-52863 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...
AZL-92982 CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...
AZL-92961 CVE-2026-46582 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...
AZL-92931 CVE-2026-44690 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...
AZL-92922 CVE-2026-44687 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in...
AZL-92925 CVE-2026-50045 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypasses a security configuration that...
AZL-93072 CVE-2026-16560 affecting package 389-ds-base 3.1.1-12
A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...
AZL-92949 CVE-2026-40691 affecting package unbound for versions less than 1.25.2-1
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger th...
AZL-92964 CVE-2026-42955 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...
AZL-92952 CVE-2026-32665 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...
AZL-92943 CVE-2026-44621 affecting package unbound for versions less than 1.25.2-1
With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...
AZL-92985 CVE-2026-41637 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...
AZL-92967 CVE-2026-14586 affecting package unbound for versions less than 1.25.2-1
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. When interfacing with libngtcp2, for...
AZL-93096 CVE-2026-16473 affecting package sbc 2.0-6
A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...
AZL-93231 CVE-2026-16517 affecting package libarchive 3.7.7-7
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...
AZL-93312 CVE-2026-47143 affecting package rust for versions less than 1.90.0-10
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling 3DNow! opcodes 0F 0F in builds compiled with -DCAPSTONEX86REDUCE, allowing a remote attacker to crash any application using the reduced X86...
AZL-92879 CVE-2026-47143 affecting package capstone 4.0.2-4
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling 3DNow! opcodes 0F 0F in builds compiled with -DCAPSTONEX86REDUCE, allowing a remote attacker to crash any application using the reduced X86...
AZL-93105 CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
AZL-93213 CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
AZL-93222 CVE-2026-56852 affecting package kubernetes for versions less than 1.30.10-27
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
AZL-93153 CVE-2026-56852 affecting package containerized-data-importer for versions less than 1.62.0-7
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...