CVE-2026-104721 is a path-traversal vulnerability in the Logback-classic module by QOS.CH Sarl. It arises when an MDC-based discriminator value is used unsanitized in a nested FileAppender path, allowing an attacker who can influence the MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This affects Logback-classic versions from 0.9.14 through 1.6.4. The vulnerability is similar to CVE-2026-19880 but involves different attack techniques.
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift
nodejs and D lang bindings.
Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.
This issue affects Apache Thrift before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A reachable assertion vulnerability exists in the getblock RPC method of the Zcash Foundation's Zebra node before version 11.0.0. When called with verbosity level 2 for a side-chain block, the method panics due to an unexpected conversion of a -1 confirmations sentinel value to an unsigned 32-bit integer, causing the node process to abort. This can be triggered remotely by unauthenticated attackers, including via the lightwalletd interface, potentially causing the node to enter a crash loop.
CVE-2026-82458 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving memory allocation with an excessive size value. This flaw affects multiple language bindings including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The issue allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The vulnerability is fixed in Apache Thrift version 0.25.0.
CVE-2026-94633 is a high-severity vulnerability in Apache Thrift before version 0.25.0 affecting the Dart bindings. It involves improper handling of length parameters leading to memory allocation with an excessive size value. This flaw can cause memory-related issues such as crashes or potential denial of service. The issue is fixed in Apache Thrift version 0.25.0.
A vulnerability in the DTLS handshake reassembly of Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0 allows a remote unauthenticated DTLS peer to cause a denial of service by triggering excessive memory allocation. This occurs because the reassembly buffer size is allocated based on a 24-bit length from the fragment header without validating against the peer's maximum handshake message size. Both DTLS clients and servers are affected, but TLS is not impacted.
CVE-2026-63569 is a critical vulnerability in the DHAgreement.CalculateAgreement function of Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0. It involves improper input validation in the MTI/A0 two-pass Diffie-Hellman key agreement protocol. An attacker on the communication path can cause the local party to compute a shared secret value already known to the attacker, undermining the key authentication guarantees. Additionally, a malicious peer can extract partial information about the local static private key and potentially recover it entirely in certain group settings. This vulnerability affects only applications that invoke DHAgreement directly.
A vulnerability in the AES-CCM implementation of Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0 allows an attacker to modify encrypted content without detection. This occurs due to improper validation of the integrity check value when the authentication tag length is zero or outside the expected range defined by RFC 5084. The flaw affects decryption processes that accept unchecked tag lengths, enabling undetected tampering of CCM-encrypted data.
CVE-2026-102731 is a high-severity vulnerability in Apache Directory LDAP API versions 1.2.0 up to but not including 1.2.9. It involves memory allocation with an excessive size value triggered by a malicious BER-encoded response, leading to an OutOfMemoryError and denial of service. The issue allows an attacker to exhaust the client JVM heap with a small number of connections. The vulnerability is fixed in version 1.2.9.
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request or other structure whose name contains a long attribute value made up of characters that must be escaped, such as commas, or of leading or trailing spaces, because each escaping backslash was inserted into the buffer being scanned, so the work grew quadratically with the length of the value. Applications are exposed when they convert such a name to a string, for example to log or display it, or compare it with IetfUtilities.RdnAreEqual, as PKIX path validation does for directoryName name constraints.
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException.
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.
CVE-2026-63574 is a high-severity vulnerability in Legion of the Bouncy Castle Inc.'s bc-csharp library before version 2.7.0. It involves memory allocation with an excessive size value in the OpenPGP signature and user attribute subpacket parsers. An unauthenticated remote attacker can supply a crafted OpenPGP public key, certificate, or signature that triggers a denial of service by causing an OutOfMemoryException or memory exhaustion during parsing. This occurs because the parser uses the declared length from a subpacket header to allocate memory without upper bounds or validation against the enclosing packet size, potentially requesting up to about 2 GB of memory. The vulnerability affects all versions from 0 up to but not including 2.7.0.