CWE-617 vulnerabilities

CVE-2026-102071 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated adjacent attacker can exploit this vulnerability by sending a specific RSVP packet, causing a denial of service (DoS). The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 6.5, indicating a medium severity level. There is no indication of known exploits in the wild, and no official patch links are provided in the input data.

CVE-2026-92151 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue occurs in the Svc::Ccsds::SpacePacketDeframer dataIn_handler, which treats a minimum packet-length condition as an assertion failure rather than gracefully rejecting the input. When a CCSDS telecommand frame payload is six bytes or fewer after header and trailer removal, the assertion triggers, aborting or resetting the flight software process and causing a denial of service. This vulnerability is fixed in version 4.2.0.

CVE-2026-102070 is a reachable assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS. This flaw allows an unauthenticated network attacker to disrupt the rmopd service by sending a specific TCP packet. The vulnerability affects multiple versions of Junos OS prior to certain fixed releases. It has a high severity rating with a CVSS score of 7.5, indicating a significant impact on service availability without confidentiality or integrity compromise.

CVE-2026-102063 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS on MX Series routers. It allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF. The vulnerability affects multiple versions of Junos OS prior to specific fixed releases. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.

CVE-2026-104005 is a high-severity vulnerability in MongoDB Server's mongos component, the sharded cluster router. An authenticated user with readWrite privileges can exploit a reachable assertion flaw by crafting a specially formed aggregation pipeline. This triggers an internal aggregation stage lacking proper authorization checks, causing an unhandled fatal error that crashes the mongos process and results in denial of service for all clients using that router.

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVE-2026-109944 is a reachable assertion vulnerability in FreeRDP versions 3.0.0 before 3.32.0. The flaw occurs because card handles are not removed when Emulate_SCardReleaseContext releases a smartcard-emulation context. This leads to a stale handle being used later by Emulate_SCardTransmit, causing the client to hit a terminating assertion and crash. A malicious RDP server can exploit this by releasing a context, establishing another, and issuing SCardTransmit with the stale handle, crashing clients with smartcard emulation and redirection enabled.

FreeRDP versions 3.11.0 contain a reachable assertion vulnerability in the urb_isoch_transfer function. This flaw allows malicious RDP servers to crash clients by sending specially crafted OutputBufferSize values exceeding INT32_MAX in TS_URB_ISOCH_TRANSFER IN-direction requests over URBDRC. The assertion failure occurs in libusb_udev_isoch_transfer, causing client termination.

CVE-2026-107838 is a high-severity vulnerability in RIOT-OS affecting versions from 2023.07 through 2026.07. It involves unchecked return values in the nanocoap_fileserver component, where failure from _resp_init() is ignored, leading to assertion failures and termination of the affected service or device task when processing specially crafted CoAP requests with large extended tokens. No official fix is available as of the latest review.

CVE-2026-39453 is a vulnerability in Red Lion Controls 700 Series switches where navigating to a specific URL on the device's web server causes it to reboot. This behavior can be exploited to create denial-of-service (DoS) conditions by repeatedly triggering the reboot via automated tools like curl.

CVE-2026-102916 is a reachable assertion vulnerability in the illumos bhyve instruction emulator that allows a guest VM to cause the host to panic. The issue arises when emulating REP-prefixed MOVS or STOS instructions accessing guest MMIO, where a status flag is not cleared properly, leading to a VERIFY assertion failure and host panic. A privileged user inside a guest VM can exploit this to cause denial of service to the host and all other guests. The flaw has existed since 2020 and affects illumos distributions prior to a specific commit fixing the issue.

vLLM versions prior to 0.30.0 contain an improper input validation vulnerability in the /inference/v1/generate endpoint. This flaw allows crafted inputs in several fields to cause termination of the shared EngineCore, poison or retrieve cross-request encoder-cache state, and alter replayed transport semantics. The issue is resolved in version 0.30.0.

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message "Expected a cached item," producing a shared-service availability failure. This issue is fixed in version 0.28.0.

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870473 / MOLY00814393; Issue ID: MSV-9041.

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service.

Pexip Infinity versions prior to 40.1 contain a vulnerability due to improper input validation in the signaling implementation. This flaw allows an attacker to trigger a reachable assertion, causing the software to abort and resulting in a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability.

Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service.

CVE-2026-96422 is a reachable assertion vulnerability in Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. It causes a crash in the frame protocol metadissector, leading to a denial of service condition. The vulnerability requires local access and user interaction to be exploited and does not impact confidentiality or integrity.