Live threat intelligence radar

An out-of-bounds memory access vulnerability exists in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF version 2.2.1. This flaw allows an unauthenticated remote attacker to cause a denial of service by repeatedly establishing SCTP associations, leading to a process crash due to improper file descriptor bounds checking in the FD_SET() operation.

A server-side request forgery (SSRF) vulnerability exists in AndyFactory newspaper4k versions up to 0.9.6 in the Article.parse function of the Image Extractor component. This vulnerability allows remote attackers to manipulate requests. The issue is fixed in version 0.9.6.1.

Open5GS version 2.8.0 contains a memory exhaustion vulnerability in its HTTP/2 SBI server. An unauthenticated remote attacker can exploit repeated header names and HPACK compression to cause persistent heap growth, leading to process memory exhaustion and termination of the affected network function, resulting in denial of service.

A denial-of-service vulnerability in open5GS v2.8.0 affects the PFCP transaction handling path. Exhaustion of PFCP transaction or timer resources leads to improper handling of a NULL return in ogs_pfcp_xact_remote_create(), causing an assertion failure and process termination. This disrupts service and prevents session establishment until the affected component is restarted.

OpenAirInterface Core Network version 2.2.1 contains a stack-based buffer overflow vulnerability in the UDM Nudm_UEAU Generate Authentication Data endpoint. This flaw arises because attacker-controlled input is converted into fixed-size stack buffers without proper size validation, allowing memory corruption. An unauthenticated attacker with access to the SBI interface and a valid SUPI can exploit this to overwrite stack memory, corrupt the stack canary, and cause the UDM process to terminate.

An integer underflow vulnerability exists in the NAS decoder of OpenAirInterface CN5G AMF version 2.2.1. This flaw allows an unauthenticated remote attacker to cause a denial of service by sending crafted NAS Registration Requests with a truncated SUCI in the 5GS Mobile Identity IE. The vulnerability arises from insufficient length validation in the DecodeSuci() function, leading to an out-of-bounds heap read and subsequent crash of the AMF process.

A high-severity vulnerability in the Linux kernel tracing subsystem involves improper locking when updating modules in persistent instances. The flaw occurs because trace_module_record() accesses ftrace_trace_arrays without holding the trace_types_lock, leading to a potential use-after-free condition during concurrent module load or unload operations.

A stack-based buffer overflow vulnerability exists in Kamailio versions 6.1.3 and 6.1.4 within the ims_qos_npn module. The vulnerability arises from the w_rx_aar_register() function copying an attacker-controlled host field from the SIP Via header into a fixed-size 46-byte stack buffer without length validation. An unauthenticated remote attacker can exploit this by sending a crafted SIP REGISTER request, causing stack corruption and termination of the Kamailio process, resulting in denial of service.

CVE-2026-99237 is a high-severity vulnerability in the Linux kernel tracing subsystem. It involves improper locking when resetting last boot data from readers, which can lead to double freeing of memory and concurrent modification issues. The flaw arises because update_last_data_if_empty() is called without holding the required trace_types_lock in certain code paths, allowing race conditions between readers and module notifiers.

CVE-2026-99229 is a Linux kernel vulnerability in the io_uring subsystem where a task can spin indefinitely on a stuck overflow list. This occurs because io_cqring_wait_schedule() returns early when IO_CHECK_CQ_OVERFLOW_BIT is set, preventing proper flushing of the overflow list and causing the task to spin in the kernel without responding to signals, including SIGKILL. The issue arises especially with IORING_SETUP_CQE_MIXED and when the application manipulates the completion queue head, leading to a stuck state that cannot be interrupted.