A vulnerability in GnuTLS version 3.8.13 allows an attacker to obtain sensitive information by exploiting the failure to reject end-entity X.509 certificates that have conflicting Key Usage and Extended Key Usage extensions. The issue has a low severity with a CVSS score of 3.7 and does not impact integrity or availability.
A vulnerability in GnuTLS version 3.8.13 causes legitimate Certificate Authority (CA) certificates to be incorrectly rejected, resulting in a Denial of Service (DoS) condition. This issue does not impact confidentiality or integrity but can disrupt availability by preventing valid certificate validation.
CVE-2026-95210 is a vulnerability in GnuTLS version 3.8.13 where improper certificate validation causes the application to accept certificates containing invalid extensions. This flaw can lead to partial compromise of confidentiality and integrity. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or remediation information is currently provided.
CVE-2026-95184 is a vulnerability in GnuTLS version 3.8.13 where improper certificate validation causes legitimate certificates to be rejected, resulting in a Denial of Service (DoS). This flaw does not impact confidentiality or integrity but disrupts availability by preventing valid users from authenticating.
A hostname verification bypass vulnerability exists in GnuTLS version prior to 3.8.13. This flaw allows attackers to circumvent the Common Name fallback mechanism, potentially enabling eavesdropping on communications when a crafted certificate is used. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in pgjdbc, the PostgreSQL JDBC Driver versions 42.7.11 through 42.7.13, allows bypassing authentication restrictions when the requireAuth connection property excludes all known authentication methods. This misconfiguration causes the driver to accept any authentication method requested by the server, including cleartext password authentication, potentially exposing database passwords to an attacker positioned between the application and server. The issue is fixed in version 42.7.14, which rejects such connections with an error.
CVE-2026-107282 is a critical vulnerability in the AsyncHttpClient (AHC) Java library that allows cleartext transmission of sensitive information. Versions prior to 3.0.13 and 2.16.1 have a flaw where cross-host request replay can cause the original host's sensitive data, including path, Host header, and Authorization credentials, to be sent to an unintended replay destination. This occurs due to improper updating of the target request and proxy context during failover and retry scenarios. The issue is fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain an origin validation error affecting connection pooling with NTLM and Negotiate authentication. The connection pool key does not include the authenticated principal, allowing a pooled socket authenticated for one user to be reused by another, causing the server to execute requests under the wrong identity. Basic and Digest authentication methods are not affected. This vulnerability is fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability in the ThreadSafeCookieStore where domain attributes are validated but public suffixes are not rejected. This allows a host under a public suffix (e.g., co.uk) to set cookies for the entire suffix, causing cookies to be shared across unrelated hosts. This can lead to injection or overwriting of session-relevant cookies across origins. The issue is fixed in versions 3.0.13 and 2.16.1.
CVE-2026-107279 is a high-severity vulnerability in AsyncHttpClient version 3.0.12 where the authentication algorithm incorrectly handles Digest qop=auth-int. This flaw causes the mutual-authentication verification to be skipped, allowing a peer that does not know the shared secret to be accepted as an authenticated server. The issue is fixed in version 3.0.13.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability where Digest authentication challenges with missing or empty nonces are incorrectly treated as Basic authentication challenges. This causes the client to resend credentials in cleartext using Basic authentication, exposing sensitive information. The issue affects both origin and proxy challenge parsers and has been fixed in versions 3.0.13 and 2.16.1.
### Summary
A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.
In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.
### Affected package and versions
- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 1.0.0-beta0001, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.
The parser defect is present from the first published NuGet prerelease, `1.0.0-beta0001`, through the latest published release, 4.1.1. The automatic `Image.Load` conversion path used by the main PoC exists in `>= 4.0.0, <= 4.1.1`; earlier versions expose the same parser defect through the public `IccProfile.Entries` accessor.
### Details
The reproduced profile has an `A2B0` multi-process-elements (`mpet`) tag with a
`clut` element declaring 15 input channels, 15 output channels, and three grid
points per input channel. [`ReadClutF32`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/ICC/DataReader/IccDataReader.Lut.cs#L139-L162)
computes `3^15 * 15` and allocates that many floats before reading any CLUT
values or verifying that the tag has enough remaining data. The supplied
200-byte profile ends immediately after the CLUT grid descriptor.
In v4, the path is reached when an application decodes an embedded ICC profile using
`DecoderOptions.ColorProfileHandling = ColorProfileHandling.Convert`. The
default setting, `Preserve`, does not parse the profile for conversion.
In v1 through v3, `ReadClutF32` uses a jagged representation. Loading an ICC-bearing JPEG and then accessing `decoded.Metadata.IccProfile.Entries` reaches the public lazy parser. The malformed profile allocates the `3^15`-entry outer array before the missing CLUT values are detected.
### Reproduction environment and result
The supplied automatic-conversion exploit and control were run against the published NuGet 4.1.1
`net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and
.NET runtime 8.0.30. The same conversion fixture was run against published 4.0.0 and 4.1.0 with the same result.
Published 1.0.0, 2.0.0, 2.1.13, 3.0.0, and 3.1.12 were tested through public JPEG decode followed by `IccProfile.Entries`; each allocated approximately 114.9 MB, skipped the malformed tag, and exited normally. The published `1.0.0-beta0001` public `IccProfile(bytes).Entries` path allocated 114,813,528 bytes before a catchable managed bounds exception.
One exploit decode increased `GC.GetTotalAllocatedBytes(true)` by approximately
861.5 million bytes, then returned
`InvalidIccProfileException: Invalid conversion method`.
The reader catches the truncated-tag error and drops that tag. The identical
input with `ColorProfileHandling.Preserve` completed successfully with roughly
0.5 million allocated bytes in the harness.
One complete exploit run produced:
```text
mode=exploit profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
observed_exception=SixLabors.ImageSharp.Metadata.Profiles.Icc.InvalidIccProfileException: Invalid conversion method.
managed_bytes_allocated=861476416
Docker exit status: 0
```
The control from the same image produced:
```text
mode=control profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
decoded=1x1 icc_present=True
managed_bytes_allocated=511888
Docker exit status: 0
```
The exact allocation counter includes runtime allocations and varies slightly
between processes; the requested CLUT array itself is 860,934,420 bytes.
No active exploitation is known.
### Impact
This report demonstrates a large attacker-controlled transient allocation in
the ICC conversion path. It does not demonstrate unhandled process termination:
allocation failure is caught while parsing the malformed tag, so the impact
should be limited to memory pressure / input-validation failure unless a
reproduction demonstrates a stronger result.
### Complete PoC files
Program.cs:
```csharp
using System;
using System.Buffers.Binary;
using System.IO;
using System.Reflection;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats;
using SixLabors.ImageSharp.Formats.Png;
using SixLabors.ImageSharp.Metadata.Profiles.Icc;
using SixLabors.ImageSharp.PixelFormats;
static class Program
{
private const int RequestedFloats = 215233605; // 3^15 * 15
private co
ImageMagick versions prior to 7.1.2-30 and 6.9.13-55, when built without Cairo support, contain a vulnerability where a crafted RSVG image that hits a resource limit can cause a double free and use-after-free in the RSVG decoder, leading to a process crash. This issue has been fixed in the specified versions.
ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a vulnerability in the CUT encoder due to a missing security-policy check. This flaw allows crafted local encoding operations to read data that should be denied by policy and can cause a crash. The issue is fixed in versions 7.1.2-31 and 6.9.13-56.
ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a vulnerability where a crafted image can bypass security policies that use 'coder' as their domain, potentially allowing unauthorized reading of data restricted by the policy. This issue has been fixed in versions 7.1.2-31 and 6.9.13-56.
ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a vulnerability in the MVG decoder where a crafted image can cause an invalid memory free, leading to a process crash. This denial-of-service issue is fixed in the specified versions.
ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a vulnerability where unescaped or untrimmed values can lead to code injection in output generated by PostScript coders. This vulnerability has been fixed in versions 7.1.2-31 and 6.9.13-56. The CVSS 3.1 score is 6.5, indicating a medium severity issue.
ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a vulnerability in the MVG decoder where a missing limit check can cause an excessively long-running operation when processing a crafted MVG image. This can lead to a denial of service condition due to resource exhaustion. The issue has been fixed in versions 7.1.2-31 and 6.9.13-56.