ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.
An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.
This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.
CVE-2026-104895 is a high-severity vulnerability in the FasterXML jackson-dataformat-smile library's asynchronous Smile parser. It involves unbounded memory allocation based on a length prefix from untrusted input, leading to potential OutOfMemoryError or NegativeArraySizeException crashes. The flaw allows attackers to cause denial of service by submitting crafted Smile data without requiring privileges or user interaction. Fixed versions are available.
CVE-2026-104016 is an integer overflow vulnerability in FasterXML jackson-dataformat-protobuf affecting multiple version ranges before fixed releases. The flaw occurs during parsing of length-prefixed protobuf string and bytes fields, where 32-bit signed integer arithmetic overflow allows bypassing bounds checks. This leads to an attempt to allocate an excessively large array, causing an OutOfMemoryError. The issue cannot be mitigated by JVM heap size tuning or existing string/document length limits. No special privileges or user interaction are required beyond submitting data for parsing. Fixed versions are available.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)
When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-trajmetrics
Reasons (based on the campaign):
- native-extension
- files-exfiltration
The npm package 'csec-form-validatorr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The ccsseecc-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The ccsseecc-crypto-toolkit npm package contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete control by an outside entity, risking all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The npm package ccsec-form-validator contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of the malicious software or attacker control.
The ccsec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The csec-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The csec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have gained full control of the system.
A vulnerability in authd allows improper validation of user identities when matching accounts from identity providers. This flaw could enable an attacker to gain unauthorized access to another user's local account and files, potentially exposing sensitive information. The issue affects versions prior to 0.7.1, including 0.6.1, 0.6.1ubuntu0.1, and 0.7.0. A fix is available in version 0.7.1, and users are advised to update and restart authd to apply the patch.
CVE-2026-3909 is a high severity security vulnerability affecting multiple specific versions of the QtWebKit open source component. It has a CVSS 3.1 base score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. The vulnerability requires no privileges and can be exploited remotely with user interaction. A security update has been issued to address this flaw.
A vulnerability in the Linux kernel's dm-integrity subsystem causes a NULL pointer dereference leading to a crash when the device is activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag is set. The issue occurs during the dm_integrity_resume function's attempt to read the journal containing the bitmap. The patch modifies dm-integrity to skip writes during resume if the device is activated in 'R' mode.
A vulnerability in the Linux kernel's dm-integrity module allows an attacker to modify the superblock on the underlying device while the dm-integrity device is suspended. This causes a mismatch between the in-memory and on-disk superblock data upon resume, potentially leading to out-of-bounds memory writes.
CVE-2026-99085 is a Linux kernel vulnerability affecting the CPU hotplug process when tasks managed by the BPF scheduler remain on a CPU that is going offline. This can cause the CPU hotplug thread to hang, potentially stalling the CPU offline operation. The issue arises because tasks on the BPF scheduler are still counted on the CPU's runqueue, but the CPU no longer dispatches these tasks, leading to a deadlock scenario. The fix involves re-enqueuing tasks on the local dequeue and ensuring dispatch continues until the runqueue goes offline.
CVE-2026-99084 is a vulnerability in the Linux kernel's readdir implementation where an inode lock is not taken on an immutable directory. This can cause readers to hold a shared lock for extended periods, potentially stalling other operations such as mkdir or lookups in certain mount namespaces. The issue affects specific Linux kernel versions and has been resolved by adding an immutable flag to directories that never change, allowing iterate_dir() to skip the lock.
A heap out-of-bounds write vulnerability exists in the Linux kernel's ksmbd component within the krb5_authenticate() function. The flaw occurs when processing SMB2_SESSION_SETUP as a non-first element in a compounded SMB2 request, causing an incorrect calculation of buffer headroom. This miscalculation allows memcpy() to write past the end of the allocated buffer into adjacent kernel heap memory. The issue has been fixed by adjusting the calculation to correctly reflect the remaining buffer space.
CVE-2026-99082 is a vulnerability in the Linux kernel's KVM x86 virtualization component related to the handling of per-vCPU MMIO cache and memslot generations. The flaw involves improper use of memslots when the vCPU runs in System Management Mode (SMM), which can lead to stale cache entries and incorrect memory accesses. This can cause KVM to bypass write-tracking for certain memory pages, potentially allowing continued use of outdated shadow translations. The issue has been fixed by ensuring the active memslots are used for caching and validation, distinguishing between normal and SMM address spaces.
CVE-2026-99081 is a vulnerability in the Linux kernel's bnxt_en driver affecting Intel BCM57412 NetXtreme-E NICs. It involves incorrect DMA mapping length for padded small packets, causing the NIC's DMA engine to read beyond the mapped buffer boundary. This results in IOMMU DMA read faults and transmit queue timeouts. The issue arises because the DMA mapping length does not account for padding added to small packets, leading to a DMA read buffer overrun. The vulnerability was introduced after a commit that changed VLAN headroom handling, causing small packets to be positioned near page boundaries. The fix ensures the DMA mapping length matches the padded packet size by adjusting skb length before mapping.