A vulnerability in Asterisk's LDAP realtime driver (res_config_ldap) prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases allows unauthenticated attackers to perform LDAP filter injection via crafted SIP usernames. This can lead to arbitrary LDAP queries and information disclosure. The module is not loaded by default and must be configured to access an LDAP server. The issue is fixed in the specified versions.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
libosmocore versions up to 1.14.1 contain out-of-bounds read vulnerabilities in the IPA CCM identity-tag parsers located in src/gsm/ipa.c. This flaw allows remote attackers to read sensitive information from memory. The issue affects multiple specific versions of libosmocore, including several Debian and Ubuntu package builds. No public exploit code or active exploitation is reported. The severity is assessed as medium based on the impact of information disclosure.
libosmocore versions through 1.14.1 contain an out-of-bounds read vulnerability in the CBSP WRITE-REPLACE decoder located in src/gsm/cbsp.c. This flaw can be exploited by a remote attacker to cause a denial of service condition.
A buffer overflow vulnerability exists in libosmocore through version 1.14.1 in the function osmo_iuup_compute_payload_crc() located in src/gsm/iuup.c. This flaw allows a remote attacker to cause a denial of service. Multiple specific versions of libosmocore are affected. No public exploit code or active exploitation in the wild is currently known.
HashiCorp Consul and Consul Enterprise contain an authorization bypass vulnerability in health check registration that allows an authenticated user to modify health checks of other services on the same node. This issue is identified as CVE-2026-115804 and has a medium severity rating. The vulnerability is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.
HashiCorp Consul and Consul Enterprise versions 1.17.0 up to 2.0.4 have an authorization bypass vulnerability in the agent's service mesh leaf certificate API. This flaw could allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. The vulnerability is identified as CVE-2026-105765 and has a high severity rating with a CVSS score of 7.5. Fixed versions are available in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
HashiCorp Consul and Consul Enterprise contain a denial of service vulnerability in the HTTP API that allows unauthenticated attackers to exhaust memory on a Consul agent. This vulnerability is identified as CVE-2026-105626 and has a high severity rating. It affects specific versions of Consul prior to 2.1.0. The issue is resolved in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.
HashiCorp Consul and Consul Enterprise contain an authorization bypass vulnerability in service mesh proxy registration. This flaw allows users with service write permission to apply Envoy escape-hatch configurations without needing mesh write permission. The vulnerability is identified as CVE-2026-105608 and has a high severity score of 8.8. It is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.
The Espressif AES driver in Zephyr OS incorrectly manages hardware key registers for multiple concurrent AES sessions. This causes operations on one session to potentially use the key and direction of another session, leading to cryptographic failures where data is encrypted or decrypted under an unintended key. The issue arises because key programming occurs outside a mutex lock, allowing race conditions between sessions. Exploitation requires an application to hold multiple concurrent sessions with different keys, which is not currently done by in-tree Zephyr subsystems. The fix involves reprogramming the key and direction inside the lock for each operation.
A vulnerability in Zephyr's Bluetooth Classic Hands-Free Profile Audio Gateway role allows a remote device to cause a crash or hang of the Bluetooth stack. This occurs when an SDP discovery is started but the subsequent RFCOMM connection fails, leading to a use-after-free or null pointer dereference in the SDP client request list. The flaw can be triggered by a remote device advertising an invalid RFCOMM channel or by racing connection attempts. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled and using the Audio Gateway role are affected.
A vulnerability in Zephyr's Bluetooth host affects the handling of connectable advertising sets when multiple extended advertising sets are used. The Bluetooth host pre-allocates connection objects (reservations) for each advertising set, but due to a lookup flaw, a reservation can be misattributed to a different advertising set. This causes the reservation for the undirected advertising set to be stranded and never released, leading to resource exhaustion. An attacker can exploit this by repeatedly triggering connections, eventually preventing new connections and causing advertising failures. The impact is limited to availability; no memory corruption or data disclosure occurs. Configurations with only one advertising set are not affected.
The Zephyr IPv6 stack used a non-cryptographically secure random number generator to derive the long-lived secret key for computing RFC 7217 stable and RFC 8981 temporary interface identifiers. This key is critical for ensuring the unpredictability of generated IPv6 interface identifiers. Because the generator state can be recovered by observing device traffic, an attacker can predict or track device addresses across networks, defeating privacy protections. There is no impact on memory safety, integrity, or availability. The issue affects experimental features that are disabled by default. The fix replaces the insecure generator with a cryptographically secure one and aborts IID generation if secure randomness is unavailable.
Netty netty-tcnative versions before 2.0.84.Final have a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback. This flaw arises from improper handling of the non-application ring buffer write index, allowing remote TLS peers to trigger an out-of-bounds memory copy. Exploitation can cause the JVM process to crash during handshake, renegotiation, or post-handshake message processing.
OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contain an out-of-bounds read and write vulnerability in the function opj_dwt_encode_and_deinterleave_v() located in src/lib/openjp2/dwt.c. This vulnerability can be exploited by an attacker to cause a denial of service condition.
CVE-2026-90885 is an XML External Entity (XXE) vulnerability in the Apache Camel Saxon component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability arises because the default Saxon Configuration used by the XQueryBuilder allows DOCTYPE declarations and external entity resolution when the message body is already a javax.xml.transform.Source. This can lead to disclosure of files readable by the Camel process and can cause the process to issue network requests to attacker-controlled hosts. Fixed versions are 4.18.5, 4.22.2, and 4.23.0.
A NULL pointer dereference vulnerability in gssproxy allows any local user to crash the daemon by sending a GSSX_INIT_SEC_CONTEXT request missing the target_name field. This causes the daemon to dereference a NULL pointer and crash, resulting in a persistent denial of service since the daemon does not automatically restart. Dependent services such as Kerberized NFS and IdM are also affected.
CVE-2026-99099 addresses a vulnerability in the Linux kernel related to AMD processors where the processor may fail to invalidate a TLB entry during execution of an INVLPGB/TLBSYNC instruction pair. This issue is identified as AMD TLBI Erratum #1718. The vulnerability has been resolved by detecting the erratum and applying a software workaround when a microcode fix is not present.
A buffer overflow vulnerability in the Linux kernel's dm-integrity module was fixed. The issue occurs in inline mode when the tag size is larger than the on-stack buffer used for checksums, causing padding to overflow the buffer. This overflow can trigger a kernel panic with stack protection enabled. The flaw requires root privileges to exploit and does not pose a direct security risk to unprivileged users.
A vulnerability in the Linux kernel's TEE subsystem allows zero-sized shared memory allocations via tee_dyn_shm_alloc_helper(). This occurs because the function does not check for zero size before calculating pages, leading to an invalid allocation request that can trigger kernel warnings and potentially cause a kernel panic during boot on systems with panic_on_warn enabled. The flaw is triggered by the TEE_IOC_SHM_ALLOC ioctl with a zero size parameter. The issue has been resolved by rejecting zero-sized allocations.