CWE-476: NULL Pointer Dereference vulnerabilities

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.

A NULL pointer dereference vulnerability exists in Tor versions before 0.4.9.7 when a CERT cell is received out of order. This issue is tracked as CVE-2026-44602 and is categorized under CWE-476. The vulnerability has a low CVSS score of 3.7 and does not impact confidentiality, integrity, but may cause a low impact on availability. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-8063 is a high-severity vulnerability in MongoDB Server versions 8.2.0 prior to 8.2.7. It allows an authenticated user to crash the mongod process by running $rankFusion or $scoreFusion aggregation stages with an empty pipeline on a view. The issue arises because the server attempts to read the first element of each stage's input pipeline array without checking if the array is empty, leading to a null pointer dereference and server crash.

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem contains a nil-pointer dereference vulnerability during import operations. In the snapshot import loop, the daemon iterates over entries from `srcBackup.Config.VolumeSnapshots` and assumes that each slice element is initialized, then dereferences fields such as `Name`, `Config`, `Description`, `CreatedAt`, and `ExpiresAt` without first validating the element itself. Because the yaml unmarshaler accepts explicit null array elements from an attacker-controlled index.yaml and converts them into nil pointers inside the slice, an attacker can supply a backup archive containing a null entry in the volume_snapshots array. This causes a nil-pointer dereference during custom volume import and terminates the daemon, resulting in denial of service on the affected node. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.

This update for nginx fixes the following issues - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled (bsc#1260415). - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420). - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229). - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module (bsc#1265231). - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module` (bsc#1265232). - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and `ngx_http_uwsgi_module` modules (bsc#1265233).

CVE-2026-29169 is a high-severity vulnerability in Apache HTTP Server versions 2.4.66 and earlier involving a NULL pointer dereference in the mod_dav_lock module. This flaw may allow an attacker to crash the server by sending a malicious request. The mod_dav_lock module is not used internally by mod_dav or mod_dav_fs, and its primary known use was with mod_dav_svn from Apache Subversion versions earlier than 1.2.0. Users are advised to upgrade to Apache HTTP Server version 2.4.66 or later, or alternatively remove the mod_dav_lock module to mitigate the issue.

CVE-2026-33007 is a medium severity vulnerability in Apache HTTP Server versions 2.4.66 and earlier. It involves a NULL pointer dereference in the mod_authn_socache module that can be triggered by an unauthenticated remote user. This flaw allows crashing a child process when the server is configured as a caching forward proxy. The issue does not impact confidentiality or integrity but causes a denial of service by affecting availability. Users are advised to upgrade to Apache HTTP Server version 2.4.67, which addresses this vulnerability.

CVE-2026-43864 is a low severity vulnerability in mutt before version 2.3.2 involving a NULL pointer dereference in the show_sig_summary function. This flaw can cause the application to crash, resulting in a denial of service. There is no indication of confidentiality or integrity impact. No patch information is provided in the source data.

IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4

NULL pointer dereference vulnerability in ASR1903 in ASR Lapwing_Linux on Linux (ims_client modules) allows Pointer Manipulation. This vulnerability is associated with program files sip/utils/src/sipuri.c.

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An unauthenticated attacker can trigger this by sending a crafted packet to the server port. This issue has been fixed in versions 6.0.0, 5.0.4, 4.0.7 and 3.0.14.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.