CVE-2026-94633 is a high-severity vulnerability in Apache Thrift before version 0.25.0 affecting the Dart bindings. It involves improper handling of length parameters leading to memory allocation with an excessive size value. This flaw can cause memory-related issues such as crashes or potential denial of service. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-94635 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves allocation of resources without limits or throttling due to improper handling of length parameter inconsistencies in the Lua bindings. This flaw can lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-18397 is a critical vulnerability in Thales SConnect native host component that allows unauthenticated remote code execution. It arises from improper verification of cryptographic signatures combined with memory management issues. The vulnerability exploits an unrestricted messaging interface between attacker-controlled web pages and the native host, enabling malicious input to bypass security checks. This affects versions prior to 2.16.1.0.
CVE-2026-102718 is a high-severity vulnerability in Eclipse ThreadX NetX Duo (up to version 6.5.2.202603) where the SNMP agent's OID parser improperly handles multi-byte BER lengths, leading to out-of-bounds reads. A remote unauthenticated attacker can exploit this by sending a crafted SNMP request, causing the agent to read memory beyond the packet buffer and potentially fault on systems with memory protection.
CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat involving improper handling of length parameter inconsistencies when using per-message-deflate in WebSocket communications. This flaw allows WebSocket message smuggling, potentially enabling attackers to interfere with message integrity. The vulnerability affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and some older end-of-support versions. Fixed versions are available, and users are advised to upgrade to 11.0.26, 10.1.60, or 9.1.22 to mitigate the issue.
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier.
CVE-2026-71337 is a stack-based buffer overflow vulnerability in the Windows Storage Management Provider on Microsoft Windows 10 Version 21H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.
CVE-2026-5706 is a high-severity vulnerability in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier. It involves improper handling of length parameters in extended advertisements, which can lead to out-of-bounds writes, stack corruption, and potentially remote code execution. The attack requires the malicious message to originate from a device already joined to the mesh network, and only provisioners supporting extended advertisements may be affected. No patch or official remediation guidance is currently available.
CVE-2026-71402 is a medium-severity out-of-bounds read vulnerability in the DHCPv4 packet capture code of SUSE wicked up to version 0.6.80. The flaw occurs because the function ni_capture_inspect_udp_header() incorrectly reports the IP total length as the payload length, causing the DHCPv4 client to read up to 68 bytes beyond the end of the packet buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to trigger this over-read, potentially causing the client to interpret adjacent heap memory as DHCP options. No memory writes or remote data exfiltration have been demonstrated. No official fix or patch information is currently available.
CVE-2026-81575 is a high-severity vulnerability in Wibu-Systems-AG CodeMeter Runtime versions 8.00 and 9.00. When configured as a server, the affected versions accept requests with opcode 0x5e containing a data length and data. Due to missing bounds checking on the data length, out-of-bounds reads can occur, leading to a segmentation fault and crashing the runtime.
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.
This can be triggered before authentication by any client that can reach the Bolt connector.
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.
mouse07410/asn1c is an ASN.1 compiler. In 1.4 and earlier, a memory safety vulnerability was identified in the OER decoding skeleton files generated by asn1c (specifically INTEGER_oer.c). When parsing a maliciously crafted, zero-length OER payload for a variable-length, non-negative INTEGER type, the decoder fails to validate the required bytes before extracting the Most Significant Bit (MSB). This forces a precise 1-byte Heap Out-of-Bounds (OOB) Read. Because asn1c generated code is primarily deployed to parse untrusted network inputs (such as V2X network protocols, 5G telecom headers, or X.509 certificates), when the decoder processes untrusted network-originated input, a remote attacker can exploit this to cause a Denial of Service (DoS) or trigger incorrect integer interpretation in downstream applications (e.g., protocol state poisoning or logic bypass).