CVE-2026-76182 is a medium severity vulnerability in Eclipse Jetty where the TryPathsHandler and TryFilesFilter components improperly handle URI path characters when forwarding requests to template URIs. This causes reserved characters in URI queries to be misinterpreted as multiple query parameters instead of a single parameter value.
CVE-2026-103223 is a high-severity vulnerability in Eclipse Vert.x's PostgreSQL client (io.vertx:vertx-pg-client). In affected versions, the PostgreSQL message decoder reads a 4-byte message length field without validating its maximum size. A malicious or compromised PostgreSQL server can send a message with an extremely large length value, causing unbounded memory allocation on the client and potentially leading to an out-of-memory crash before authentication completes.
A buffer overflow vulnerability exists in the SODOLA SL902-SWTGW124AS firmware versions up to 200.2.12. This flaw allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Exploitation targets the embedded HTTP server's multipart/form-data boundary parser, causing the device to become unresponsive and lose management access and traffic forwarding during recovery.
A vulnerability in the node-qs library versions 6.7.0 through 6.16.0 causes a TypeError when using qs.stringify with arrayFormat set to 'comma' on arrays containing elements that cannot be coerced to strings, such as objects with non-callable toString properties or null-prototype objects. This error can cause synchronous exceptions during query string serialization, potentially resulting in HTTP 500 errors or process crashes depending on the application's error handling.
GrowChief versions through 0.3.0 have a missing authorization vulnerability in the getAllUsers handler. This flaw allows any authenticated user, including those with low privileges, to list users across all organizations because the IsSuperAdmin authorization check is missing. Exploitation involves sending a GET request to /users/all-users with an empty or short search value, enabling enumeration of user IDs, emails, names, and organization IDs for all tenants.
FileRise versions prior to 3.21.0 have a cross-site scripting (XSS) vulnerability due to improper neutralization of input in the branding.footerHtml value exposed via an unauthenticated public site configuration API. Although the frontend sanitizes this value before rendering, the raw HTML is exposed through the API, which could be unsafe for alternate clients or future render paths. An administrator must first store a malicious footer value to exploit this issue. The vulnerability is fixed in version 3.21.0.
CVE-2026-73261 is a high-severity vulnerability in the cesanta mongoose embedded web server and network library. Prior to version 7.23, the built-in TCP/IP stack improperly validates TCP options, allowing an unauthenticated remote attacker to corrupt the per-connection Maximum Segment Size (MSS) value. This corruption causes subsequent mg_send() calls to transmit truncated or zero-length payloads, while the TCP connection appears healthy. The issue is fixed in version 7.23.
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n).
The length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value.
When the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread.
The fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames — matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c). That validation only enforced a lower bound (pkt_len < 3); its second clause rejects a FIFO that holds more bytes than declared and therefore never bounds large values. Because the driver configures the radio for variable packet length with PKT_LEN = 0xFF, the length byte is an over-the-air value of 0-255 that reached net_pkt_rx_alloc_with_buffer() and the subsequent SPI burst read unclamped.
An unauthenticated attacker within radio range can transmit a frame that presents a length byte above the IEEE 802.15.4 maximum of 127 while the chip's 128-byte RX FIFO has not overflowed, so the driver's RX_FIFO_ERROR pre-check does not fire. Reaching this state depends on RF framing and timing, since the RX thread is driven off the PKT_SYNC_RXTX signal and may sample the FIFO before a packet is complete; no pairing, authentication, or user interaction is required.
With the default CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE=128, an allocation larger than one fragment is satisfied by a chain of fragments, but read_rxfifo_content() performs a single SPI burst of pkt_len bytes into the first fragment's buf->data and then calls net_buf_add() with the same length. A length above 128 therefore writes up to 127 bytes past the end of a fragment in the contiguous rx_bufs pool and leaves a net_buf whose len exceeds its capacity. The overflowing bytes are FIFO-underflow output rather than attacker-chosen data, so the practical impact is network-buffer-pool corruption and crashes rather than a controlled write. Only builds that enable CONFIG_IEEE802154_CC1200 with an attached CC1200 radio are affected.
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register — a copy of the PHY header length byte of the frame received over the air — and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255.
Because the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array.
The length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time — before frame filtering has completed — while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.
The fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.
Godot Engine versions up to 4.7.2 contain a heap out-of-bounds write vulnerability in the binary resource loader. This occurs due to improper handling of a string length value read from a resource file, where a negative length leads to an unsigned copy operation that writes beyond the allocated heap buffer. The issue is triggered when loading a crafted binary resource file (.res). The vendor considers this outside their threat model and does not classify it as a security issue.
libsmb2 versions through 6.2 contain an integer underflow vulnerability in the decode_acl function. This flaw allows malicious SMB servers to cause heap out-of-bounds reads by sending crafted security descriptors with an AclSize value below 8 in a QUERY_INFO reply. This bypasses ACE bounds checks and can crash the client application.
RabbitMQ versions from 4.0.0 up to but not including 4.0.24, 4.1.15, 4.2.10, and 4.3.4 contain a vulnerability in the AMQP 1.0 server_mode parser. This parser incorrectly matches textual prefixes of symbolic data, sequence, and value body descriptors without verifying encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can exploit this to submit malformed descriptors that cause strict AMQP 1.0 consumers or AMQP 0-9-1 consumers to terminate unexpectedly. The broker itself remains operational, and routing or authorization is not bypassed. The issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
Tinyexr versions through 3.2.0 have a heap out-of-bounds read vulnerability in the function ParseEXRMultipartHeaderFromMemory(). This flaw allows attackers to craft multi-part EXR files that bypass bounds checks, leading to application crashes or leakage of adjacent heap memory into attribute values. The vulnerability arises from a stale remaining-size value used during parsing.
A divide by zero vulnerability exists in libschrift through version 0.10.2. This flaw allows attackers to crash applications by supplying a crafted TrueType font with a unitsPerEm value of 0 in the head table. The vulnerability also involves NaN glyph coordinates that bypass clip_points(), leading to an out-of-bounds raster read during rendering and causing process crashes.
Mini-XML versions 4.0.0 through 4.0.6 have an off-by-one stack out-of-bounds write vulnerability in the mxml_strtod() function when the locale decimal point is not '.'. An attacker can exploit this by supplying XML with a 63-digit REAL value followed by a '.' character, causing a NUL byte to be written past the 64-byte stack buffer, potentially corrupting stack memory or crashing the process. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-110598 is an integer underflow vulnerability in libyal's libpff library up to version 20260926. It occurs in the function libpff_record_entry_get_multi_value(), allowing crafted PST, OST, or PAB files with non-monotonic multi-value offsets to trigger heap out-of-bounds reads. This can cause crashes in libpff and related tools such as pypff or pffexport and potentially expose adjacent heap memory.