CWE-127 vulnerabilities

A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 can cause the response body of a large non-blocking write to be split between the current and next request on the same connection. This may lead to failure of the second request and potential data leakage from the first response to the second. The issue is fixed in version 11.0.27.

CVE-2026-110758 is a buffer under-read vulnerability in Text::CSV_XS for Perl versions before 1.65. The flaw occurs when processing all-blank fields under the allow_whitespace option in the strip_trail_whitespace function, which may read memory before the start of the field's buffer. This can lead to unintended memory reads if certain conditions are met, such as the presence of spaces or tabs before the field buffer. The vulnerability has a high severity with a CVSS score of 7.5.

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.