CWE-617 vulnerabilities

CVE-2026-19401 is a high-severity vulnerability in NLnet Labs NSD version 4.3.7 where a remote attacker can crash a server child process by sending a specially crafted DNS message containing a specific number of DNS Cookie options. This causes a reachable assertion failure in debugging or non-release builds, potentially leading to denial of DNS service if exploited repeatedly.

A reachable assertion vulnerability exists in AcademySoftwareFoundation's OpenEXR versions 3.4.0 through 3.4.12. A crafted HTJ2K-compressed EXR file with a specific QCD marker causes an unconditional process abort when exr_start_read() is called on untrusted input, leading to denial of service. The issue arises because OpenEXR passes invalid quantization delta parameters to the OpenJPH library, which uses an assertion that triggers abort(). This vulnerability is fixed in version 3.4.13.

A vulnerability in vLLM, the inference engine used by Red Hat AI Inference Server, allows unauthenticated attackers to execute arbitrary code by loading malicious HuggingFace models when vLLM runs in Python optimized mode. This affects Red Hat AI Inference Server versions prior to 0.22.0 that include the vulnerable pooler activation loader. Exploitation requires supplying untrusted models and running with Python optimization enabled. Red Hat rates the impact as Important for AI Inference Server and OpenShift AI vLLM serving images, and Moderate for RHEL AI bootc images bundling vLLM. No fix is currently available. Mitigations include avoiding Python optimization mode, loading models only from trusted sources, restricting deployment permissions, and applying network controls.

CVE-2026-63388 is a high-severity vulnerability in libevent, an event notification library. Versions prior to 2.1.13 and between 2.2.0-alpha and before 2.2.2-alpha are affected. The flaw is a heap out-of-bounds write caused by copying a kernel-supplied AF_UNIX peer address into a buffer that is too small. This can lead to memory corruption, impacting confidentiality, integrity, and availability. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.

CVE-2026-76926 is a reachable assertion vulnerability in the BUSMASTER file parser component of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to exit abnormally, resulting in a denial of service condition. The issue has a low severity rating with a CVSS score of 3.1. No known exploits are reported in the wild, and no official patch or remediation information is currently available.

A reachable assertion vulnerability exists in libheif versions 1.23.0 and earlier. When processing crafted HEIF sequences via heif_context_read_from_memory(), the context may end up with no registered sequence tracks, causing a crash when heif_context_get_track(ctx, 0) is called. This occurs because an assertion in get_track() aborts in debug builds, while release builds dereference an empty map leading to undefined behavior and typical crashes. The issue is fixed in version 1.23.1.

CVE-2026-62289 is an integer underflow vulnerability in the strukturag libheif library versions 1.23.0 and earlier. It occurs when processing a crafted HEIF or AVIF file containing a clean aperture box, which can cause image dimensions to reduce to zero and lead to crashes or corrupted tiling results. The issue arises from applying a transformation twice, causing an underflow in image dimension calculations. This vulnerability is fixed in version 1.23.1.

A reachable assertion vulnerability in ZcashFoundation's Zebra node prior to version 4.5.0 allows an unauthenticated IPv4 peer to deterministically crash a synced node. This occurs due to an address mismatch assertion triggered during mempool misbehavior handling after a P2P handshake with an invalid mempool transaction. The issue is fixed in version 4.5.0.

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVE-2026-13055 is a high-severity vulnerability in MongoDB Server affecting versions 7.0, 8.0, 8.2.0, and 8.3.0. It involves the `$_internalIndexKey` aggregation expression, which any authenticated user can use to crash the MongoDB server by triggering an internal assertion failure. This occurs due to improper handling of compound wildcard index specifications during aggregation pipeline execution.

CVE-2026-13058 is a high-severity vulnerability in MongoDB Server where an authenticated user with basic write privileges can cause the mongod process to crash by sending a crafted transaction command missing required fields. This leads to a denial of service due to an internal assertion failure caused by inconsistent validation of transaction command parameters.

CVE-2026-9737 is a high-severity vulnerability in MongoDB Server involving a reachable assertion failure during query planning. The issue arises when the server reads the sort pattern in raw BSONObj form and does not properly handle the meta expression case, potentially causing an invariant failure. This vulnerability affects specific MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-13073 is a medium severity vulnerability in MongoDB Server version 8.0 where an authenticated user with read-only privileges can cause the mongod process to crash by issuing a specially crafted aggregation command. This leads to a denial of service affecting all connected clients until the server process is restarted. The root cause is an internal engine selection inconsistency triggered by specific aggregation options.

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.