145548 matches found
php: OOM bailout during request parsing leads to memory corruption and RCE
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...
brotli: Out-of-Bounds Write in Google Brotli Decoder
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...
Important: Red Hat Security Advisory: brotli security update
An update for brotli is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
net/http: golang: golang: Denial of Service via crafted HTTP Range headers
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
podman: Arbitrary file write when importing OCI archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
Important: Red Hat Security Advisory: podman security update
An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.22.20 security update
Red Hat build of MicroShift release 4.22.20 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
flatpak: flatpak: Arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...
flatpak: Flatpak: Arbitrary code execution via missing symlink protection
A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...
flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...
flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer
A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...
Important: Red Hat Security Advisory: flatpak security update
An update for flatpak is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.21.40 security update
Red Hat build of MicroShift release 4.21.40 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.6 security update
Updated Red Hat Enterprise Linux AI 3.4.6 container images are now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This update provides the latest Red Hat Enterprise...
github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...
Important: Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...
Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.6 security update
Updated Red Hat Enterprise Linux AI 3.4.6 container disk images are now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This update provides the latest Red Hat...
qs: qs: Denial of Service via unhandled exception during array serialization
A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...
fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting XSS by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers URIs using the suffix reference option. Because the library fails to...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation
A flaw was found in kin-openapi. The runtime schema validation lacks cycle detection when processing circular schema references. A remote attacker can exploit this vulnerability by submitting a request or response that triggers recursive validation, leading to unbounded recursion and stack...
body-parser: body-parser: Denial of Service via unhandled decompression stream error
A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the...
fast-uri: fast-uri: Path traversal via improper relative URI normalization
A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier URI paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies ...
fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding
A flaw was found in fast-uri. The library incorrectly decodes percent-encoded characters in protocol schemes prior to validation, causing invalid or prohibited schemes to be accepted as valid. A remote attacker can exploit this vulnerability by submitting a specially crafted Uniform Resource...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding
A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...
fast-uri: fast-uri: Security policy bypass via improper host canonicalization
A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially...
github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values
A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails t...
jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens
A flaw was found in jose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS through memory exhaustion. When processing JSON Web Encryption JWE tokens that use compression, the library decompresses the payload without enforcing limits on the output size ...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.13-0.4.hum1 aarch64, x8664 grafana12.4-12.4.13-0.4.hum1.src src Security Fixes: grafana12.4: CVE-2026-100352 CVE-2026-100353 CVE-2026-100354 CVE-2026-110816...
Moderate: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation
A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter BPF Just-In-Time JIT...
kernel: bpf: Support for hardening against JIT spraying
A flaw was found in the Linux kernel's Berkeley Packet Filter BPF Just-In-Time JIT compiler. The BPF JIT allocator reuses memory space, and when new code is written, an indirect jump into the new program can reuse a branch prediction left behind by an old program. This could allow an attacker to...
russh: russh: Denial of Service via resource exhaustion in SSH agent
A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openshell: openshell-0.1.5-0.1.hum1 aarch64, x8664 openshell-gateway-0.1.5-0.1.hum1 aarch64, x8664 python3-openshell-0.1.5-0.1.hum1 aarch64, x8664 openshell-0.1.5-0.1.hum1.src src...
libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...
Important: Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update
An update for libxml2 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow
A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...
libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited...
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service DoS, making the affected system or application...
libxml2: double-free/UAF in libxml2 Python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...