The jose_jwk:shared_secret/2 function in the jose library derives an ECDH shared secret from two JSON Web Keys (JWKs). A flaw in its implementation causes an unbounded tail-recursive loop when the two JWKs have differing key types, such as an EC key and an RSA key. This loop consumes 100% CPU on an Erlang scheduler, leading to denial of service when exploited repeatedly. The vulnerability affects jose versions from 1.5.0 before 1.11.13.
A vulnerability in the potatosalad jose (erlang-jose) library allows remote attackers to exhaust a node's memory by sending a crafted JWE token with highly compressed data. The decompression function does not limit output size, enabling data amplification that can crash the BEAM runtime and cause denial of service. This affects versions from 1.0.0 before 1.11.13.
A Bleichenbacher padding oracle vulnerability exists in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation in the jose_jwa_pkcs1 module. The vulnerability allows an unauthenticated attacker with access to a decryption endpoint using RSA1_5 padding to recover plaintext or forge signatures through adaptive chosen-ciphertext queries. This affects jose versions from 1.3.0 before 1.11.13.
The jose library's pure-Erlang AES-GCM fallback implementation in jose_jwa_aes improperly derives the number of verified authentication tag bits from the attacker-supplied tag without validating its length. This allows an attacker controlling a JWE token to truncate the authentication tag to as few as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. This vulnerability affects versions from 1.2.0 before 1.11.13.
A heap-use-after-free vulnerability exists in Asterisk's PJSIP TCP/SDP handling when an authenticated attacker sends a SIP INVITE over a connection-oriented transport and disconnects before receiving a 200 OK response. This issue has been observed only when Asterisk is built with Address Sanitizer, a development tool not used in production. The vulnerability is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.
CVE-2026-65629 is a vulnerability in the potatosalad jose library versions from 1.10.0 up to but not including 1.11.13. It involves the use of a password hash with insufficient computational effort during the export of password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both far below current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack to recover the private key.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVE-2026-57193 is a vulnerability in the Asterisk telephony toolkit's LDAP realtime driver (res_config_ldap) that allows LDAP filter injection via a crafted SIP username. This can enable an unauthenticated attacker to perform arbitrary LDAP queries and potentially disclose information. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The res_config_ldap module must be enabled and configured to access an LDAP server for the issue to be exploitable. Fixed versions are available.
CVE-2026-57196 is a reflected cross-site scripting (XSS) vulnerability in Asterisk's phone provisioning HTTP error pages. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. An unauthenticated attacker can exploit this vulnerability to steal an authorized user's AMI session cookie and impersonate that user, but only if the HTTP server, AMI, and AMI HTTP access are enabled and the attacker can convince the user to click a malicious link. By default, the HTTP server binds to 127.0.0.1, limiting exposure. The issue is fixed in the stated versions.
libosmocore versions up to 1.14.1 contain out-of-bounds read vulnerabilities in the IPA CCM identity-tag parsers located in src/gsm/ipa.c. This flaw allows remote attackers to read sensitive information from memory. The issue affects multiple specific versions of libosmocore, including several Debian and Ubuntu package builds. No public exploit code or active exploitation is reported. The severity is assessed as medium based on the impact of information disclosure.
osmo-msc versions through 1.15.0 contain a stack-based buffer overflow vulnerability in the decode_mme_name() function located in src/libmsc/sgs_iface.c. This flaw allows a remote attacker to cause a denial of service condition.
libosmocore versions through 1.14.1 contain an out-of-bounds read vulnerability in the CBSP WRITE-REPLACE decoder located in src/gsm/cbsp.c. This flaw can be exploited by a remote attacker to cause a denial of service condition.
A buffer overflow vulnerability exists in libosmocore through version 1.14.1 in the function osmo_iuup_compute_payload_crc() located in src/gsm/iuup.c. This flaw allows a remote attacker to cause a denial of service. Multiple specific versions of libosmocore are affected. No public exploit code or active exploitation in the wild is currently known.
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
CVE-2026-115922 is a vulnerability in the Open Neural Network Exchange (ONNX) prior to version 1.22.0. The issue arises from the _unpack_2bit() and _unpack_4bit() functions resizing unpacked arrays based on attacker-controlled tensor dimensions without verifying that the raw data matches the declared number of elements. This can lead to excessive memory allocation when processing untrusted tensor data, causing memory exhaustion. The vulnerability is fixed in ONNX version 1.22.0.
A vulnerability in Open Neural Network Exchange (ONNX) versions from 1.4.0 up to but not including 1.22.0 allows untrusted models to cause denial of service by triggering null pointer dereference or excessive memory allocation during shape inference. This occurs due to improper validation of the num_scan_inputs attribute in certain ScanInferenceFunction implementations. The issue is fixed in version 1.22.0.