12350 matches found
CLEANSTART-2026-BQ91197 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages
CVE-2026-59890 affects multiple packages. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. See references for individual vulnerability details...
CLEANSTART-2026-VF53508 Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through
CVE-2026-84782 affects multiple packages. Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. See references for individual vulnerability details...
CLEANSTART-2026-YA80016 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages
CVE-2025-47273 affects multiple packages. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. See references for individual vulnerability details...
CLEANSTART-2026-DG48545 Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use
CVE-2026-84784 affects multiple packages. Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. See references for individual vulnerability details...
CLEANSTART-2026-XR25689 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel
CVE-2026-77696 affects multiple packages. Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. See references for individual vulnerability details...
CLEANSTART-2026-GI85240 urllib3 is an HTTP client library for Python
CVE-2026-97687 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-RR86072 Security fix for GHSA-6v7p-g79w-8964 applied in: miniforge3 26.3.2.3-r5, miniforge3 26.3.2.0-r2, miniforge3 26.1.1.3-r2
GHSA-6v7p-g79w-8964 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-FV21331 MessagePack is the serializer implementation for Python msgpack
CVE-2026-57585 affects multiple packages. MessagePack is the serializer implementation for Python msgpack. See references for individual vulnerability details...
CLEANSTART-2026-GA47961 urllib3 is an HTTP client library for Python
CVE-2026-97688 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-KW58831 urllib3 is an HTTP client library for Python
CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-SF17865 Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response
CVE-2026-75805 affects multiple packages. Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. See references for individual vulnerability details...
CLEANSTART-2026-KP41215 Issue summary: An established DTLS 1
CVE-2026-75806 affects multiple packages. Issue summary: An established DTLS 1. See references for individual vulnerability details...
CLEANSTART-2026-DS32463 Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams
CVE-2026-75804 affects multiple packages. Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. See references for individual vulnerability details...
CLEANSTART-2026-ZQ04316 Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet meta...
CVE-2026-63075 affects multiple packages. Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. See references fo...
CLEANSTART-2026-JP03196 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the ...
CVE-2026-75803 affects multiple packages. Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. See references for individual...
CLEANSTART-2026-WR38385 Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries
CVE-2026-54876 affects multiple packages. Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. See references for individual vulnerability details...
CLEANSTART-2026-MH33423 Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN
CVE-2026-63076 affects multiple packages. Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN. See references for individual vulnerability details...
CLEANSTART-2026-UH94851 Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`
CVE-2026-63073 affects multiple packages. Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. See references for individual vulnerability details...
CLEANSTART-2026-YQ62547 Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms
CVE-2026-54875 affects multiple packages. Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. See references for individual vulnerability details...
CLEANSTART-2026-VK14120 Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that q...
CVE-2026-63072 affects multiple packages. Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write...
CLEANSTART-2026-BP03068 Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid)
CVE-2026-63074 affects multiple packages. Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. See references for individual vulnerability details...
CLEANSTART-2026-VP80967 Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer derefere...
CVE-2026-14457 affects multiple packages. Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys an...
CLEANSTART-2026-RV52446 Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X
CVE-2026-35189 affects multiple packages. Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X. See references for individual vulnerability details...
CLEANSTART-2026-QD52056 Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet
CVE-2026-18798 affects multiple packages. Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. See references for individual vulnerability details...
CLEANSTART-2026-QG73880 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires
CVE-2026-54874 affects multiple packages. Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. See references for individual vulnerability details...
CLEANSTART-2026-SP65833 Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a...
CVE-2026-35191 affects multiple packages. Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection...
CLEANSTART-2026-OZ62377 Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary
CVE-2026-54873 affects multiple packages. Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. See references for individual vulnerability details...
CLEANSTART-2026-KH74871 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secre...
CVE-2026-54872 affects multiple packages. Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. See references for individual...
CLEANSTART-2026-DX09334 Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order
CVE-2026-42772 affects multiple packages. Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. See references for individual vulnerability details...
CLEANSTART-2026-IL62740 Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without...
CVE-2026-14456 affects multiple packages. Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. See references for individual...
CLEANSTART-2026-WK76356 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-FZ12567 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the rundeck package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-CU45491 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-PO84391 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...
CLEANSTART-2026-KI18725 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes
CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...
CLEANSTART-2026-PE13748 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...
CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...
CLEANSTART-2026-AQ16047 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...
CLEANSTART-2026-XC42294 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
CLEANSTART-2026-ER85100 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...
CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...
CLEANSTART-2026-VA55733 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...
CLEANSTART-2026-BZ34965 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...
CLEANSTART-2026-PL25237 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...
CLEANSTART-2026-UE71064 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
CLEANSTART-2026-HK40992 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...
CLEANSTART-2026-IO14442 When http
CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...
CLEANSTART-2026-BX50217 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...
CLEANSTART-2026-UI48167 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...
CLEANSTART-2026-WR32003 On Windows, when the target of Root
CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...