Threat database

CVE-2026-123578 is an authentication bypass vulnerability in hickory-dns affecting versions 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2. The flaw allows remote attackers to bypass DNS spoofing defenses by sending UDP responses with an empty question section (QDCOUNT=0), which causes the software to skip critical validation checks.

CVE-2026-123577 is a resource exhaustion vulnerability in hickory-dns versions 0.24.0 up to but not including 0.26.2. It allows remote attackers to cause denial of service by sending large DNS over HTTP (DoH) request bodies over HTTP/2 or HTTP/3, leading to server memory exhaustion.

Hickory DNS versions 0.24.0 through 0.26.1 have a memory exhaustion vulnerability due to lack of limits on resource allocation when processing incomplete DNS-over-QUIC requests. Remote attackers can exploit this by opening many connections and sending large length prefixes without completing requests, causing server memory to be exhausted.

CVE-2026-123575 is a resource exhaustion vulnerability in hickory-dns versions before 0.26.2. The DNS-over-HTTPS HTTP/2 server in affected versions lacks sufficient timeouts or limits on incomplete request bodies, allowing remote attackers to hold connections open and exhaust server memory.

CVE-2026-123574 is a high-severity vulnerability in the hickory-proto crate of Hickory DNS versions 0.24.0 up to but not including 0.26.2. The zone file parser improperly handles tokens of 4096 bytes or longer, causing the parser to panic. This can be exploited by attackers who supply maliciously crafted zone files to trigger a denial of service condition.

CVE-2026-123573 is a denial of service vulnerability in hickory-dns versions from 0.20.1 up to but not including 0.26.2. The flaw exists in the hickory-proto SVCB and HTTPS record presentation format parser, where specially crafted zone files containing a single or double quote replacing a service parameter value cause a panic that crashes the parser. This vulnerability has a high severity rating with a CVSS score of 8.7. It is fixed in version 0.26.2.

CVE-2026-123572 is a denial of service vulnerability in hickory-dns versions 0.20.1 up to but not including 0.26.2. The flaw exists in the hickory-proto SVCB and HTTPS record presentation format parser, which panics when processing malformed ALPN values such as unbalanced quotes, consecutive commas, or invalid escape sequences. This can cause the parsing process to crash when attackers supply crafted untrusted zone files.

An integer underflow vulnerability exists in Hickory DNS versions 0.26.0 up to but not including 0.26.2. The flaw occurs in the TSIG RDATA decoding process, where a crafted TSIG record can cause unchecked subtraction underflow, leading to a panic and denial of service by crashing the application. This vulnerability has a high severity score of 8.7 and is fixed in version 0.26.2.

CVE-2026-123570 is a high-severity vulnerability in hickory-dns versions 0.18 up to but not including 0.26.2. The DNS wire-format message parser preallocates memory based on untrusted header fields (ANCOUNT, NSCOUNT, ARCOUNT), which can be manipulated by remote attackers to cause excessive memory allocation of about 18MB per message. This can lead to uncontrolled resource consumption and potential denial of service.

CVE-2026-123569 is a high-severity vulnerability in the sveltejs devalue package before version 5.6.3. It allows an attacker to cause excessive CPU and memory consumption by serializing sparse arrays on the server, potentially leading to denial of service. This issue arises because the package does not limit or throttle resource allocation during serialization of such arrays. The vulnerability is fixed in version 5.6.3.

Sveltejs devalue versions before 5.6.3 have a prototype pollution vulnerability. This flaw allows attackers to manipulate object prototypes by providing untrusted input to the uneval function. When the affected code evaluates this input, it results in objects with altered prototypes, causing output data to differ in structure from the original input. The vulnerability has a low severity score and was fixed in version 5.6.3.

CVE-2026-123567 is a prototype pollution vulnerability in the sveltejs devalue library before version 5.6.4. It allows attackers to inject __proto__ properties into objects returned by devalue.parse and devalue.unflatten. This can lead to modification of an object's prototype when downstream code merges these objects using Object.assign. The vulnerability is fixed in version 5.6.4.

Sveltejs devalue versions before 5.9.3 contain a denial of service vulnerability where attackers can cause CPU amplification by supplying sparse arrays to the uneval function. This forces synchronous work proportional to the declared array length, blocking the event loop and potentially causing application unavailability.

CVE-2026-123565 is a high-severity resource exhaustion vulnerability in the sveltejs devalue library before version 5.9.3. The vulnerability arises from the uneval function, which can experience quadratic expansion when processing repeated primitive strings. An attacker can craft a small payload that, when parsed and passed to uneval, results in a very large serialized string that exhausts system memory or CPU resources. This flaw was fixed in version 5.9.3.

CVE-2026-123564 is a high-severity memory exhaustion vulnerability in the sveltejs devalue library versions from 1.0.0 up to but not including 5.9.3. The flaw exists in the uneval function, which generates code for sparse arrays that allocates memory proportional to the array's declared length during evaluation. An attacker able to influence a very large sparse array serialized by an application can cause memory exhaustion in the browser or runtime environment. This issue is fixed in version 5.9.3.

A vulnerability in the sveltejs devalue library before version 5.9.3 allows attackers to bypass validation in the parse function via custom ArrayBuffer revivers. This flaw enables the allocation of excessively large ArrayBuffers from crafted small inputs, leading to memory exhaustion and denial of service.

A vulnerability in sveltejs devalue versions 5.8.0 through before 5.9.3 causes an unhandled promise rejection during asynchronous serialization. This occurs when multiple promises are serialized and a later promise rejects before an earlier one settles, leaving an internal rejection unhandled even if the caller catches the returned promise. An attacker who can influence the timing or failure of these promises may cause the Node.js process to terminate unexpectedly.

CVE-2026-123561 is a prototype pollution vulnerability in the sveltejs 'devalue' package before version 5.9.3. It allows attackers to bypass the existing __proto__ rejection by using malformed null-prototype object keys through property-key coercion. Although the crafted payloads yield objects with a __proto__ own property, this alone does not cause prototype pollution. The issue is an incomplete fix of a previous vulnerability (GHSA-mwv9-gp5h-frr4).

Zebra versions before 7.0.0 have a vulnerability where unauthenticated peers can stall the initial synchronization process by sending a forged checkpoint block body. This forged data causes the node to reject certain hashes and stop requesting further blocks until it is restarted. The issue is fixed in version 7.0.0.

Zebra versions before 7.0.0 have an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. This causes quadratic digest recomputation under ZIP-244 or ZIP-243, stalling block verification for minutes. The issue is fixed in version 7.0.0.