19106 matches found
AZL-76808 CVE-2025-47911 affecting package yq 4.45.1-1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76793 CVE-2025-47911 affecting package azl-otel-collector 0.127.0-1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76830 CVE-2025-47911 affecting package cf-cli for versions less than 8.4.0-27
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-77016 CVE-2025-47911 affecting package kubernetes for versions less than 1.30.10-21
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76992 CVE-2025-47911 affecting package influxdb for versions less than 2.7.5-13
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-77067 CVE-2025-47911 affecting package packer for versions less than 1.9.5-13
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76950 CVE-2025-47911 affecting package kubevirt for versions less than 0.59.0-38
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-77096 CVE-2025-47911 affecting package sriov-network-device-plugin for versions less than 3.7.0-5
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76944 CVE-2025-47911 affecting package kubernetes for versions less than 1.28.4-25
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76916 CVE-2025-47911 affecting package cri-tools for versions less than 1.32.0-4
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76898 CVE-2025-47911 affecting package cni-plugins for versions less than 1.4.0-5
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76802 CVE-2025-47911 affecting package podman 5.6.1-10
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-77046 CVE-2025-47911 affecting package sriov-network-device-plugin for versions less than 3.6.2-11
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-77004 CVE-2025-47911 affecting package keda for versions less than 2.14.1-11
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76977 CVE-2025-47911 affecting package packer for versions less than 1.9.5-18
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76818 CVE-2025-47911 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76940 CVE-2025-47911 affecting package docker-compose for versions less than 2.27.0-8
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76778 CVE-2025-47911 affecting package buildah 1.18.0-29
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76743 CVE-2025-61732 affecting package msft-golang 1.24.13-1
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
AZL-78937 CVE-2025-61732 affecting package golang 1.25.7-1
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
AZL-98736 CVE-2025-61732 affecting package golang 1.27.1-1
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
AZL-76688 CVE-2025-61732 affecting package golang for versions less than 1.25.10-1
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
AZL-76721 CVE-2026-25541 affecting package rust for versions less than 1.90.0-6
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76752 CVE-2026-25541 affecting package rust 1.72.0-14
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76715 CVE-2026-25541 affecting package rpm-ostree for versions less than 2024.4-8
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76718 CVE-2026-25541 affecting package rust for versions less than 1.75.0-27
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76691 CVE-2026-25541 affecting package kata-containers for versions less than 3.19.1.kata2-6
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76703 CVE-2026-25541 affecting package netavark for versions less than 1.10.3-7
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-78615 CVE-2026-25541 affecting package trident for versions less than 0.22.0-1
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-76712 CVE-2026-25541 affecting package azl-compliance for versions less than 1.0.2-3
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-85059 CVE-2026-25541 affecting package rust-afterburn for versions less than 5.8.2-2
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...
AZL-77325 CVE-2026-23102 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds...
AZL-77283 CVE-2026-23103 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrslock be per port Make the addrslock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. ...
AZL-77235 CVE-2026-23108 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: can: usb8dev: usb8devreadbulkcallback: fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a "can: gsusb: gsusbreceivebulkcallback: fix URB memory leak". In usb8devopen - usb8devstart, the URBs for USB-in transfer...
AZL-77274 CVE-2026-23107 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's svestate before setting TIFSME. Consequently, restoring a ZA context can place a task into an...
AZL-77118 CVE-2026-23110 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes o...
AZL-77223 CVE-2026-23105 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use clisactive to determine whether class is active in qfqrmfromag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq...
AZL-77136 CVE-2026-23095 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. 0 The repro generated a GUE packet with its inner protocol 0. gueudprecv returns -guehdr-protoctype for "resubmit" in ipprotocoldeliverrcu, but thi...
AZL-77322 CVE-2026-23099 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: bonding: limit BONDMODE8023AD to Ethernet devices BONDMODE8023AD makes sense for ARPHRDETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in hwaddrcreate net/core/devaddrlists.c:63 inline BUG: KASAN: global-out-of-boun...
AZL-77229 CVE-2026-23098 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: netrom: fix double-free in nrrouteframe In nrrouteframe, oldskb is immediately freed without checking if nrneigh-ax25 pointer is NULL. Therefore, if nrneigh-ax25 is NULL, the caller function will free oldskb again, causing a...
AZL-80285 CVE-2026-23100 affecting package kernel for versions less than 6.6.130.1-1
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlbpmdshared Patch series "mm/hugetlb: fixes for PMD table sharing incl. using mmugather", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I...
AZL-77181 CVE-2026-23097 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock analyzed by Lance Yang: 1 Task 5749: Holds foliolock, then tries to acquire immaprwsemread lock. 2 Task 5754: Holds immaprwsemwrite lock, then tri...
AZL-77142 CVE-2026-23101 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to ledslist when it is fully ready Before this change the LED was added to ledslist before ledinitcore gets called adding it the list before ledclassdev.setbrightnesswork gets initialized. This leave...
AZL-77160 CVE-2026-23091 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the th device during output device open on errors and on close. Note that a recent commit fixed the leak in a couple of open error path...
AZL-77202 CVE-2026-23083 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOUATTRIPPROTO. fouudprecv has the same problem mentioned in the previous patch. If FOUATTRIPPROTO is set to 0, skb is not freed by fouudprecv nor "resubmit"-ted in ipprotocoldeliverrcu. Let's forbid 0 for...
AZL-77145 CVE-2026-23088 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: cd...
AZL-77247 CVE-2026-23089 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in sndusbmixerfree When sndusbcreatemixer fails, sndusbmixerfree frees mixer-idelems but the controls already added to the card still reference the freed memory. Later when sndcardregister runs...
AZL-77259 CVE-2026-23084 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in becmdgetmacfromlist When the parameter pmacidvalid argument of becmdgetmacfromlist is set to false, the driver may request the PMACID from the firmware of the network card, and this functio...
AZL-77217 CVE-2026-23085 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIGARMLPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while...
AZL-77151 CVE-2026-23086 affecting package kernel for versions less than 6.6.126.1-1
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peerbufalloc, which is set from the remote endpoint's SOVMSOCKETSBUFFERSIZE value. On the host side this means that the...