SUSE CVE-2026-58023

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

SUSE CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58060

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58062

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58063

In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

SUSE CVE-2026-58218

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the...

SUSE CVE-2026-58221

unknown...

SUSE CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

SUSE CVE-2026-58224

unknown...

SUSE CVE-2026-58389

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

SUSE CVE-2026-58662

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

SUSE CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

SUSE CVE-2026-59639

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

SUSE CVE-2026-59640

In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

SUSE CVE-2026-59641

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

SUSE CVE-2026-59642

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X seri...

SUSE CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

SUSE CVE-2026-59644

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender...

SUSE CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

SUSE CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

SUSE CVE-2026-59647

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

SUSE CVE-2026-59648

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

SUSE CVE-2026-59649

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

SUSE CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

SUSE CVE-2026-59651

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

SUSE CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

SUSE CVE-2026-62423

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

SUSE CVE-2026-62424

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

SUSE CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

SUSE CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

SUSE CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

SUSE CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

SUSE CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check. addrconfifdown clears dev-ip6ptr with RCUINITPOINTER after rt6disableip has...

SUSE CVE-2026-64539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

SUSE CVE-2026-64540

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...

SUSE CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

SUSE CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

SUSE CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

SUSE CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

SUSE CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

SUSE CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

SUSE CVE-2026-64547

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the skb-len != packetlen check further down, and packetlen is only bound...

SUSE CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

SUSE CVE-2026-64549

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

SUSE CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

SUSE CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

SUSE CVE-2026-64552

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

SUSE CVE-2026-64553

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...