A vulnerability in the Zephyr OS Object Transfer Service (OTS) server allows a remote attacker within radio range to cause a denial of service or leak uninitialized memory. The flaw arises from improper handling of the Object Action Control Point (OACP) response indication when processing a Calculate Checksum command that fails validation. This can lead to a panic on assertion-enabled builds or disclosure of four bytes of uninitialized stack memory on others. No pairing or authentication is required to exploit this issue.
A denial of service vulnerability exists in netty-tcnative versions before 2.0.84.Final. The flaw is in the tcn_write_to_bytebuffer BIO write callback, which overreports bytes consumed. This can be triggered by remote TLS 1.3 peers sending queued post-handshake records such as NewSessionTicket or KeyUpdate, causing truncated flights, connection failures, or JVM process aborts.
A use-after-free vulnerability exists in netty-tcnative versions before 2.0.84.Final when built against OpenSSL 3.x. The flaw occurs during TLS session ticket key rotation, where remote clients performing TLS handshakes can trigger OpenSSL to read freed HMAC keys, potentially causing crashes or corruption in ticket processing.
Netty netty-tcnative versions before 2.0.84.Final have a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback. This flaw arises from improper handling of the non-application ring buffer write index, allowing remote TLS peers to trigger an out-of-bounds memory copy. Exploitation can cause the JVM process to crash during handshake, renegotiation, or post-handshake message processing.
OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contain an out-of-bounds read and write vulnerability in the function opj_dwt_encode_and_deinterleave_v() located in src/lib/openjp2/dwt.c. This vulnerability can be exploited by an attacker to cause a denial of service condition.
CVE-2026-99095 is a vulnerability in the Linux kernel's drm/vc4 driver where the hangcheck timer and job completion works are not properly drained during V3D unbind. This leads to timer callbacks accessing freed memory, causing potential use-after-free conditions. The issue was identified by static analysis and has been resolved by ensuring the timer and related work are properly shut down and flushed during unbind.
A Linux kernel vulnerability was fixed that prevented scheduling deferred kernel page table freeing during system boot. The issue caused kernel panics when using a boot-time function tracer with a filter, due to workqueue usage before initialization. The fix defers scheduling the freeing work until the system is fully booted.
Security Fix(es):
* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)
* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)
* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)
* golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)
* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)
* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)
* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)
* golang: golang: Denial of Service via crafted HTTP Range headers
(CVE-2026-78667)
* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/tls: Denial of Service via multiple ECH outer extension
references (CVE-2026-97031)
* golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which can cause objects from one class loader to be substituted into another. This leads to ClassCastException failures when newInstance() returns objects of the wrong class.
A resource exhaustion vulnerability exists in the WebSocket fragment reassembly of bandit versions from 1.11.0 before 1.14.0. An unauthenticated remote attacker can send many 1-byte continuation frames to exhaust server memory. The server does not limit the number of fragments, allowing memory usage to exceed configured limits significantly. Ping frames can keep the connection alive, bypassing idle timeouts.
An Inefficient Algorithmic Complexity vulnerability exists in the header integer parser of the bandit HTTP server. This flaw allows an unauthenticated remote attacker to cause excessive CPU consumption by sending HTTP requests with extremely large numeric values in headers such as content-length or Host port. The vulnerability affects bandit versions from 1.0.0-pre.7 up to but not including 1.14.0. The issue arises because the parser builds the integer one digit at a time without limiting digit count, causing quadratic time complexity and high CPU usage.
An improper cleanup on thrown exception vulnerability exists in the HTTP/2 handler of the bandit project. This flaw allows an unauthenticated remote attacker to bypass per-connection resource limits by sending a single TCP write containing multiple frames, one of which triggers a stream error. The handler improperly rolls back connection state, causing resource limits like max_concurrent_streams and max_requests to be bypassed, potentially leading to resource exhaustion. This affects bandit versions from 1.9.0 up to but not including 1.14.0.
A vulnerability in the HTTP/2 implementation of the bandit server allows an unauthenticated remote attacker to cause unbounded growth in memory and CPU usage per connection. This occurs because the server resizes its HPACK encoder table to the size specified by the client in SETTINGS_HEADER_TABLE_SIZE without any server-side limit. The table grows with each response due to unique header values, causing CPU cost to increase quadratically with the number of responses on a connection. This affects bandit versions from 0.3.6 up to but not including 1.14.0.
A vulnerability in the WebSocket connection handling of bandit allows a remote client to continue executing WebSocket handler code after the server has sent a Close frame and stopped the connection. This occurs because the connection process remains in a :closing state and subsequent frames are still processed, potentially allowing unauthorized actions such as running admin-only commands after a failed token check. The issue affects specific versions of bandit prior to 1.14.0.
A vulnerability in the HTTP/2 implementation of the bandit server allows unauthenticated remote attackers to exhaust server memory by sending a small HPACK-compressed HEADERS block that references a large cookie value many times. This causes excessive memory allocation before application code runs, potentially leading to denial of service. The issue affects bandit versions from 0.3.3 up to but not including 1.14.0.
An inefficient algorithmic complexity vulnerability exists in the HTTP/2 implementation of the bandit server, allowing unauthenticated remote attackers to exhaust server CPU resources. The issue arises from the handling of small SETTINGS or connection-level WINDOW_UPDATE frames, which cause the server to perform costly O(n²) operations when many streams are blocked. This vulnerability affects bandit versions from 0.3.4 before 1.14.0 and has a high severity rating with a CVSS score of 8.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.