CVE-2026-9750 is a high-severity vulnerability in MongoDB Server that allows an authenticated user to cause the server to crash or return incorrect query results. The issue arises from insufficient separation between user-controlled document fields and internal metadata during query execution, leading to reachable assertions. This affects specific MongoDB Server versions including 7.0.0, 8.0.0, 8.2.0, and 8.3.0.
CVE-2026-9749 is a high-severity vulnerability in MongoDB Server affecting versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. It arises when an aggregation pipeline uses the internal $exchange stage with key-range partitioning and order-preserving delivery, leading to a reachable assertion due to improper handling of a full per-consumer buffer. This can cause the server to reach a code path where the internal high watermark for a key range is not updated as intended.
CVE-2026-9748 is a high-severity vulnerability in MongoDB Server involving a reachable assertion failure. The issue arises from the $_internalConvertBucketIndexStats stage using PauseExecution incorrectly as a skip signal, which is intended only for internal coordination by $facet. When this stage precedes $facet in a pipeline, it causes an unexpected PauseExecution signal that triggers a hard invariant assertion failure, crashing the mongod process.
CVE-2026-9747 is a high-severity vulnerability in MongoDB Server where adding the parameters fromRouter:true and runtimeConstants.userRoles can cause aggregation operations to crash the server. This is due to a reachable assertion issue classified under CWE-617. The vulnerability affects specific versions of MongoDB Server including 7.0.0, 8.0.0, 8.2.0, and 8.3.0. No official patch or remediation guidance has been provided yet.
CVE-2026-9746 is a high-severity vulnerability in MongoDB Server that causes the server to crash due to a reachable assertion failure when using $changestreams and $_requestReshardingResumeToken with the exchange option. The issue requires the user to be logged in but does not require special privileges. Affected versions include 7.0.0, 8.0.0, 8.2.0, and 8.3.0. There is no confirmed patch or official remediation available at this time.
A denial of service vulnerability exists in python-markdown due to malformed HTML-like sequences. This issue is tracked as CVE-2025-69534 and affects certain versions of python-markdown used in Red Hat Enterprise Linux 9. The vulnerability can cause the application to become unresponsive or crash when processing crafted input. Red Hat has issued a security advisory and provided updates to address this issue.
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response. This issue has been patched in zebrad version 4.3.1 and zebra-rpc version 6.0.2.
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100.
CVE-2026-34067 is a low-severity vulnerability in the nimiq-transaction Rust library used by Nimiq. Before version 1.3.0, the function HistoryTreeProof::verify contains an assertion that panics if a malformed proof has mismatched lengths between history and positions arrays. Since the proof data is attacker-controlled from untrusted peer-to-peer network responses, a malicious actor could cause the application to crash by sending a crafted proof with length mismatch. The issue is fixed in version 1.3.0. No workarounds are known.
A vulnerability in nimiq-blockchain versions prior to 1.3.0 allows a remote peer to cause a panic via improper input validation in the HistoryStore component. Specifically, the function put_historic_txns uses an assert to enforce block number invariants, which can be violated by a malformed history list during history synchronization, leading to a denial of service. The issue is fixed in version 1.3.0. No known workarounds exist.
A reachable assertion vulnerability exists in Nimiq's network-libp2p prior to version 1.3.0. The network-libp2p discovery protocol handler incorrectly assumes only one inbound and one outbound discovery substream per connection. If a remote peer opens a second discovery substream on the same connection, the handler triggers a panic, causing the networking task to crash and the node's p2p networking to go offline until restarted. This denial-of-service condition affects availability but does not impact confidentiality or integrity. The issue is fixed in version 1.3.0. No known workarounds are available.
A reachable assertion vulnerability exists in nimiq/core-rs-albatross versions 1.2.2 and below. An unauthenticated peer can send a crafted RequestMacroChain message that causes the handler to panic due to an unexpected micro block hash being treated as a macro block hash. This leads to a denial of service condition by crashing the task handling the message. The issue is fixed in version 1.3.0.
A reachable assertion vulnerability (CWE-617) in ISC Kea DHCP daemons (kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, kea-dhcp6) allows a denial of service via a stack overflow triggered by a maliciously crafted message sent over any configured API socket or HA listener. This affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. Red Hat has issued security advisories and updates to address this issue.
CVE-2026-30867 is a reachable assertion vulnerability in the CocoaMQTT client library for iOS and macOS prior to version 2.2.2. The flaw exists in the packet parsing logic, where a 4-byte malformed payload with the RETAIN flag set can be published to a shared topic on an MQTT broker. When a vulnerable client subscribes to this topic, the broker pushes the malformed packet, causing the client application to crash immediately in the background. This results in a persistent denial-of-service condition until the retained message is removed from the broker. The issue has been patched in CocoaMQTT version 2.2.2.
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE control message with an attacker-controlled, near-maximum backoff value, the value is accepted and stored as an Instant near the representable upper bound. On a later heartbeat, the implementation performs unchecked Instant + Duration arithmetic (backoff_time + slack), which can overflow and panic with: overflow when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mplex/yamux connectivity and requires no further authentication beyond becoming a protocol peer. This issue has been patched in version 0.49.4.