Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds.
An attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a workflow pod carries a malformed workflows.argoproj.io/pod-gc-strategy annotation. Because the panic occurs inside an informer goroutine (outside the controller's recover() scope), it crashes the entire controller process. The poisoned pod persists across restarts, causing a crash loop that halts all workflow processing until the pod is manually deleted. This vulnerability is fixed in 4.0.5 and 3.7.14.
CVE-2026-6840 is a medium severity vulnerability in Samsung Open Source ONE prior to version 1.30.0. It involves improper validation of an array index (CWE-129) during model loading, where missing bounds checks on an operator code could allow out-of-range lookups. This vulnerability does not impact confidentiality or integrity but can cause availability issues. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild, and the product is not a cloud service. Users should monitor vendor advisories for updates on remediation.
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. When processing a device-attest-01 ACME challenge using TPM attestation, Step CA validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A crafted certificate could include an EKU extension that decodes to an empty sequence, causing the code to panic when accessing the first element of the empty slice. This vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured. Deployments not using TPM device attestation are not affected. This vulnerability is fixed in 0.30.0-rc3.
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
CVE-2026-33762 is a low-severity vulnerability in the go-git library prior to version 5.17.1. It involves improper validation of the path name prefix length in the index decoder for Git index format version 4. This flaw can cause an out-of-bounds slice operation leading to a runtime panic during normal index parsing. Only format version 4 is affected; earlier formats v2 and v3 are not vulnerable. The issue has been fixed in go-git version 5.17.1.
Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with invalid PDU Session IDs outside of 1-15. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added PDU Session ID validations during NGAP message handling.
CVE-2026-33022 is a medium severity denial-of-service vulnerability in Tekton Pipelines affecting multiple versions prior to patched releases. It arises from improper validation of array indices when generating deterministic names for TaskRun or PipelineRun resources with custom resolver names longer than 30 characters. This causes the controller to panic due to invalid string slicing, leading to a cluster-wide controller crash and a CrashLoopBackOff state. The impact blocks all CI/CD pipeline reconciliation until the offending resource is manually removed. Built-in resolvers are unaffected, but any custom resolver name exceeding 30 characters triggers the issue. The vulnerability requires authenticated users with permission to create TaskRun or PipelineRun resources but no user interaction beyond resource creation. Fixed versions have been released that properly truncate the resolver name prefix to prevent the panic. Organizations using Tekton Pipelines with custom resolvers should upgrade immediately to avoid disruption.
CVE-2026-32937 is a high-severity vulnerability in free5GC's CHF component prior to version 1.2.2, caused by improper validation of array indexes leading to out-of-bounds slice access. An authenticated attacker can trigger a server-side panic via a crafted PUT request to the recharge endpoint, causing service disruption. While some deployments convert this panic into HTTP 500 errors, others may experience more severe outages. The vulnerability can be exploited repeatedly to degrade recharge functionality and flood logs, impacting availability. Mitigations include restricting access to trusted network functions, applying rate limiting, disabling the recharge API if unused, and ensuring panic recovery and monitoring are in place. This vulnerability affects 5G core network deployments using free5GC CHF, particularly in countries with active 5G infrastructure adopting open-source core solutions. The CVSS 4.0 score is 7.
CVE-2026-26933 is a medium severity vulnerability in Elastic Packetbeat versions 8.0.0 and 9.0.0 caused by improper validation of array indices in multiple protocol parsers. An attacker on the same network segment or controlling routed traffic can send malformed packets that trigger out-of-bounds reads, leading to application crashes or resource exhaustion, resulting in denial of service. Exploitation does not require user interaction but does require low privileges and network access to monitored interfaces. No known exploits are currently reported in the wild. The vulnerability impacts availability but not confidentiality or integrity. Organizations using Packetbeat for network monitoring should prioritize patching or mitigating exposure to untrusted network traffic.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, the value of the mate reference id field was not validated. Later use of this value, for example when converting the data to SAM format, could result in the out of bounds array reads when looking up the corresponding reference name. If the array value obtained also happened to be a valid pointer, it would be interpreted as a string and an attempt would be made to write the data as part of the SAM record. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the `cram_decode_seq()` function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM `MD` tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
CVE-2026-31965 is a medium severity out-of-bounds read vulnerability in the htslib library used by samtools for processing bioinformatics file formats, specifically CRAM files. The flaw occurs in the cram_decode_slice() function where reference ID validation happens too late, allowing two out-of-bounds reads before error detection. This can lead to leaking of two values to the caller or cause program crashes due to invalid memory access. Exploitation does not require authentication or user interaction and can be triggered remotely by processing crafted CRAM files. Fixed versions 1.21.1, 1.22.2, and 1.23.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the `cram_decode_seq()` did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followed by writing a single attacker-controlled byte to the same location. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
CVE-2026-30984 is a medium severity vulnerability in the iccDEV library used for ICC color profile management. It involves a heap out-of-bounds read in the CIccCalculatorFunc::ApplySequence() function, which can cause application crashes. The flaw affects versions prior to 2.3.1.5 and requires user interaction but no privileges. Exploitation is local and can lead to denial of service but not data integrity or confidentiality loss. No known exploits are currently in the wild. The issue is fixed in version 2.3.
CVE-2026-30982 is a heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the function CIccPcsXform::pushXYZConvert(), where a heap out-of-bounds read can cause application crashes and potentially leak memory contents. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability impacts confidentiality and availability but not integrity, and no known exploits are currently reported in the wild. The issue is fixed in version 2.3.1.
Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.