144028 matches found
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references
A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames
A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...
Important: Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read a...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance
A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...
Critical: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
Moderate: Red Hat Security Advisory: pipewire security update
An update for pipewire is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
pipewire: Pulse Server alloca Stack Overflow
Multiple unbounded alloca calls in the PulseAudio protocol server...
pipewire: RAOP RTSP NULL Deref
RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...
kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps
A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...
kernel: ipvs: reload ip header after head reallocation
A flaw was found in the Linux kernel's IP Virtual Server IPVS module. When processing network packets, a buffer reallocation can leave an IP header pointer referencing freed memory. An attacker could exploit this use-after-free condition to cause a Denial of Service DoS by crashing the system or...
kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...
kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()
A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...
kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap
A flaw was found in libceph in the Linux kernel. A remote attacker, acting as a malicious monitor, could send a specially crafted OSDMap Object Storage Device Map with an overly long pgtemp or pgupmap entry. This could lead to a stack out-of-bounds write, resulting in a kernel bug and potentially...
kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...
kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...
kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...
kernel: ipvs: do not propagate one-packet flag to synced conns
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
Critical: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability...
kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update
A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...
gcc: Stack overflow in std::bitset on libstdc++
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: gcc13: gcc13-13.5.0-0.4.hum1 aarch64, s390x, x8664 gcc13-c++-13.5.0-0.4.hum1 aarch64, s390x, x8664 gcc13-gfortran-13.5.0-0.4.hum1 aarch64, s390x, x8664 gcc13-plugin-annobin-13.5.0-0.4.hum1 aarch6...
hdf5: hdf5: Denial of Service via NULL pointer dereference
A flaw was found in HDF5. An attacker can cause a Denial of Service DoS by convincing a user or application to open a specially crafted HDF5 file. Due to improper handling of corrupted metadata in local heap structures, the library attempts to dereference a NULL pointer during cache operations,...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hdf5: hdf5-2.2.0-0.1.5.hum1 aarch64, s390x, x8664 hdf5-devel-2.2.0-0.1.5.hum1 aarch64, s390x, x8664 hdf5-mpich-2.2.0-0.1.5.hum1 aarch64, s390x, x8664 hdf5-mpich-devel-2.2.0-0.1.5.hum1 aarch64,...
hdf5: hdf5: Denial of Service via heap buffer over-read in external link traversal
A flaw was found in HDF5. When traversing external links, the library fails to validate the length of user-supplied link data, resulting in a heap buffer over-read. By convincing a user or application to open a specially crafted HDF5 file containing a malformed external link, an attacker can caus...
hdf5: hdf5: Denial of Service via heap buffer over-read
A flaw was found in hdf5. When parsing object header messages, insufficient boundary checks can allow an attacker to trigger a heap buffer over-read by convincing a user or application to open a specially crafted file. Successful exploitation could cause the application to crash, resulting in a...
Critical: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: qt6-qtbase: qt6-qtbase-6.12.0-1.1.hum1 aarch64, s390x, x8664 qt6-qtbase-common-6.12.0-1.1.hum1 noarch qt6-qtbase-devel-6.12.0-1.1.hum1 aarch64, s390x, x8664 qt6-qtbase-examples-6.12.0-1.1.hum1...
qt: qt: Denial of Service via NULL pointer dereference during QCborValue to JSON conversion
A flaw was found in Qt. This vulnerability allows an attacker to trigger a Denial of Service DoS by providing specially crafted Concise Binary Object Representation CBOR data. When the application converts this input into JavaScript Object Notation JSON format using QCborValue, a NULL pointer...
follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.4-0.6.hum1 aarch64, s390x, x8664 grafana13.2-13.2.4-0.6.hum1.src src Security Fixes: grafana13.2: CVE-2026-116591 CVE-2026-116689 CVE-2026-110910...
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input
A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...
qs: qs: Query parameter injection via unencoded empty array keys
A flaw was found in qs. When the library is configured to allow empty arrays during query string serialization, it fails to encode object keys that contain empty array values. A remote attacker who can provide untrusted input key names can exploit this flaw by supplying keys containing query...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust-rpm-sequoia: rpm-sequoia-1.10.3-0.3.hum1 aarch64, s390x, x8664 rpm-sequoia-devel-1.10.3-0.3.hum1 aarch64, s390x, x8664 rust-rpm-sequoia-1.10.3-0.3.hum1.src src Security Fixes:...
rust-rpm-sequoia: rust-rpm-sequoia: Denial of Service via crafted RPM file during signature verification
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager RPM file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an...
sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...
dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal
A flaw was found in dnspython. A remote attacker can cause a Denial of Service DoS by sending a specially crafted Domain Name System DNS message containing excessive compression pointer chains. Because the parser does not enforce a hop limit during name decompression, processing these malformed...
Important: Red Hat Security Advisory: python-dns security update
An update for python-dns is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
Critical: Red Hat Security Advisory: Red Hat AI Inference 3.5.3 (CUDA)
Red Hat AI Inference 3.5.3 CUDA is now available. Red Hat AI Inference...
Critical: Red Hat Security Advisory: Red Hat AI Inference Tech Preview 3.5.3 (Gaudi)
Red Hat AI Inference Tech Preview 3.5.3 Gaudi is now available. Red Hat AI Inference Tech Preview...
Critical: Red Hat Security Advisory: Red Hat AI Inference 3.5.3 (Spyre)
Red Hat AI Inference 3.5.3 Spyre is now available. Red Hat AI Inference...
Critical: Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)
Red Hat AI Inference Model Optimization Tools 3.5.3 CUDA is now available. Red Hat AI Inference Model Optimization Tools...