Threats Tagged 'cve-2026-26209'

Red Hat® AI Inference Server

Red Hat® AI Inference Server

CVE-2026-26209 is a high-severity vulnerability in the cbor2 Python library versions prior to 5.9.0. It arises from uncontrolled recursion when decoding deeply nested CBOR data structures, allowing an attacker to cause a Denial of Service (DoS) by crashing the worker process. The vulnerability affects both the pure Python and C extension implementations, which rely on Python's recursion limits rather than enforcing a strict depth limit. An attacker can craft a CBOR payload with approximately 100,000 nested arrays to exhaust the stack, triggering a RecursionError and terminating the process. This can be exploited repeatedly with small payloads to disrupt applications using cbor2, such as web servers and task queues. Version 5.9.0 patches this issue.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-26209#cwe-674

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.