The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
SunEditor versions from 3.0.0 up to but not including 3.4.0 contain a stored cross-site scripting (XSS) vulnerability in the html.clean() function. This flaw arises because the function rebuilds iframes from JSON data without properly filtering certain attributes like srcdoc or uppercase SRC keys. An attacker can exploit this by injecting crafted HTML through paste, html.set, or html.insert methods, leading to script execution in the context of the host page when the content is loaded or pasted.
CVE-2026-123616 is a high-severity vulnerability in imgproxy versions 3.3.0 up to but not including 4.0.16. It involves an unbounded memory allocation flaw in the ICO image loader, where the data_size field is not validated. An attacker can supply a crafted ICO file with a large declared data_size (~4GB) to cause memory exhaustion and crash worker processes without requiring authentication. The issue is fixed in imgproxy version 4.0.16.
CVE-2026-123615 is a high-severity vulnerability in imgproxy versions 3.3.0 up to but not including 4.0.17. It involves an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction, which can be triggered by an unauthenticated remote attacker supplying a crafted ICO image. This leads to corruption of adjacent heap chunk metadata and causes a glibc abort that crashes the worker process. The issue is fixed in imgproxy version 4.0.17.
A heap-based buffer overflow vulnerability exists in imgproxy versions 4.0.0 up to but not including 4.0.16. The flaw is due to an integer overflow in the ICO image loader's data_size value, which can cause heap memory corruption. This can lead to process crashes or potentially allow remote code execution.
CVE-2026-123613 is a vulnerability in rustls versions from 0.23.13 up to but not including 0.23.45. It involves improper input validation where TLS 1.3 handshake messages are accepted at incorrect encryption levels following a key change in the same record. This flaw allows a peer or on-path attacker to send a plaintext EncryptedExtensions message alongside the ServerHello, which rustls mistakenly accepts as unencrypted.
An information disclosure vulnerability exists in rustls versions 0.23.44 and 0.23.45. When Encrypted Client Hello (ECH) is rejected, application data buffered before handshake completion is sent to the client-facing server instead of being properly isolated. This occurs because start_traffic() queues plaintext data before sending the ech_required alert, causing the authenticated public_name server to receive data intended for the inner server. The issue is fixed in rustls version 0.23.46.
CVE-2026-123611 is a key exchange downgrade vulnerability in rustls versions before 0.23.46. It allows network attackers to manipulate the per-server-name key-exchange group record via an unauthenticated ServerHello message. By responding with a ServerHello selecting the X25519 algorithm, attackers can cause subsequent ClientHello messages to use classical key shares, thereby losing post-quantum confidentiality.
CVE-2026-123610 is a medium-severity vulnerability in rustls versions before 0.23.46. It involves uncontrolled memory allocation in the optional Brotli certificate decompression feature. Malicious peers can exploit this by sending a specially crafted certificate that requests up to 1 GiB of memory before authentication, potentially causing clients or servers to abort if they cannot allocate the requested memory.
CVE-2026-123609 is an information disclosure vulnerability in rustls versions before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2. The flaw arises from derived Debug formatting of client session values, which can expose secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue risk leaking TLS 1.2 master secrets or TLS 1.3 resumption PSKs to anyone with access to the logs.
CVE-2026-123608 is a denial of service vulnerability in hickory-dns versions from 0.3.1 up to but not including 0.26.1. The flaw exists in the BinEncoder component, where a quadratic-time name compression algorithm can be exploited by remote attackers. By sending malicious DNS messages with many records and candidate labels, attackers can trigger repeated linear scans during encoding, leading to CPU exhaustion.
CVE-2026-123607 is a high-severity vulnerability in Hickory DNS affecting versions 0.25.0-alpha.3 through 0.25.2 and 0.26.0-alpha.1 through before 0.26.1. It involves an unbounded loop in the DnssecDnsHandle component during NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. This can lead to memory exhaustion or panic in debug builds when malicious upstream attackers return crafted NoData or NXDomain responses with cross-zone SOA records. The issue is fixed in version 0.26.1.
CVE-2026-123606 is a high-severity vulnerability in hickory-dns recursor versions 0.25.0-alpha.3 through 0.25.2 and hickory-resolver versions 0.26.0-alpha.1 before 0.26.2. The flaw allows remote attackers to cause uncontrolled resource consumption by serving referrals with out-of-bailiwick NS targets lacking glue records. This triggers repeated A and AAAA DNS lookups per target without any per-query work budget, potentially amplifying traffic against remote servers or exhausting the recursor's resources. The issue is fixed in version 0.26.2.
CVE-2026-123605 is a high-severity vulnerability in Hickory DNS affecting versions 0.1 through 0.25.0-alpha.3 and 0.26.0-beta.1 up to but not including 0.26.2. The flaw allows DNSSEC validation bypass due to improper verification of cryptographic signatures. Specifically, the validator accepts RRSIG signatures against the DNSKEY of any name in the Signer's Name field without confirming that this name matches the zone of the RRset. This enables attackers controlling any secure zone to forge valid signatures over arbitrary records in unrelated zones, potentially misleading resolvers, recursors, and clients using DnssecDnsHandle into accepting unauthenticated data as authentic. The issue is fixed in version 0.26.2.
CVE-2026-123604 is a high-severity vulnerability in hickory-dns resolver versions 0.26.0-beta.1 up to but not including 0.26.2. It involves an infinite loop caused by an unbounded retry mechanism in the NameServerPool::try_send function, which re-queues truncated DNS responses without limiting retries. A malicious authoritative DNS server can exploit this by continuously sending truncated responses, causing the resolver to consume resources until the request times out after 5 seconds.
CVE-2026-123603 is an improper access control vulnerability in hickory-dns components prior to version 0.26.2. The affected versions fail to properly canonicalize IPv4-mapped IPv6 addresses when enforcing deny_answers, deny_server, or AccessControlSet rules. This allows attackers to bypass filtering, trigger queries to denied nameservers, or access hickory-server deployments on dual-stack IPv6 sockets from clients that should be denied.
CVE-2026-123602 is a high-severity vulnerability in the Hickory DNS recursor and resolver prior to version 0.26.2. It allows an attacker to perform ghost domain name attacks by exploiting the reuse of stale apex NS RRsets cached from zone NS queries. This flaw enables name servers that have been revoked by the parent zone to continue answering queries indefinitely by repeatedly querying the zone's NS records.
CVE-2026-123601 is a vulnerability in Hickory DNS affecting versions 0.25.0 through 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. The flaw involves inverted relational operators in the wrap-around branch of the find_covering_record() function in nsec3.rs, causing the last NSEC3 record in a zone's hash ring to incorrectly cover every hash except its owner. This allows attackers who can inject DNS responses to replay that NSEC3 record and its RRSIG, forging DNSSEC-validated negative responses that deny legitimate DNS names. The vulnerability has a high severity with a CVSS 4.0 score of 8.3. A fix is available in version 0.26.2.
CVE-2026-123600 is a vulnerability in hickory-dns affecting versions 0.25.0-alpha.3 through 0.25.2 and 0.26.0-alpha.1 before 0.26.2. It involves a DNSSEC validation flaw where the component DnssecDnsHandle incorrectly accepts certain NSEC3-signed NODATA responses for zone-apex queries as secure without proper matching NSEC3 records. This allows on-path attackers or malicious authoritative servers to replay signed non-apex NSEC3 records with the zone's signed SOA, resulting in an authenticated denial of any apex resource record type for the negative-cache TTL period. The issue has a medium severity with a CVSS 4.0 score of 6.3 and is fixed in version 0.26.2.
CVE-2026-123599 is a vulnerability in hickory-dns where DNSSEC validation can be bypassed due to improper handling of DNS class in verify_rrsets(). This allows attackers supplying DNS responses to forge certain DNS records, potentially authenticating any DNSKEY and forging child zone responses. The issue affects hickory-proto versions before 0.26.0-beta.1 and hickory-net versions before 0.26.2. A fix is available in versions 0.26.0-beta.1 and 0.26.2.