MariaDB Connector/J versions from 3.0.0 up to but excluding 3.3.7, 3.4.5, and 3.5.10 contain a vulnerability in length parameter handling. The issue arises because certain methods improperly convert an unsigned 8-byte length-encoded integer to a Java int without verifying that the value fits within a non-negative integer range. This can cause negative array sizes, out-of-bounds errors, or excessive memory allocation when processing data from a malicious or compromised server or a man-in-the-middle attacker. The vulnerability is fixed in versions 3.3.7, 3.4.5, and 3.5.10.
MariaDB Connector/J versions from 3.0.0 up to but not including 3.3.7, 3.4.5, and 3.5.11 contain an out-of-bounds read vulnerability in the decoding of certain server packets. This flaw allows a malicious or compromised server, or a man-in-the-middle attacker, to cause exceptions that terminate connection handling. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions 3.0.0 up to but not including 3.3.7, 3.4.0 up to 3.4.5, and 3.5.0 up to 3.5.11 contain a vulnerability involving improper handling of length parameters in OK packet parsing. A malicious or compromised server, or a man-in-the-middle attacker, can exploit this by sending a small OK packet that declares a larger length, causing repeated heap allocations and potentially leading to OutOfMemoryError in the client application. This issue has been fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVE-2026-115794 is a vulnerability in RT-Labs P-Net versions before 1.0.3 where the application alarm callback receives a length parameter derived from a variable part length field without verifying it against the actual frame length. This can cause the callback to process a length up to 65507 bytes, leading to out-of-bounds reads if the application copies this data. Exploitation requires an established Application Relationship and adjacent network access. Applications not using alarm data are not affected. The issue is fixed in version 1.0.3.
CVE-2026-116531 is a critical vulnerability in HTTP::Body for Perl versions before 1.23_01. It involves improper handling of chunk boundaries in HTTP chunked request bodies, causing the server to lose track of chunk boundaries when a read ends inside a chunk. This can cause a server to hang or prematurely treat a chunked body as complete, potentially disrupting request processing.
CVE-2026-114597 is a vulnerability in EPICS Base versions up to and including 7.0.10 where improper validation of length or element values in network messages can cause out-of-bounds reads. This flaw may lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114646 is a vulnerability in the MongoDB C# Driver affecting versions from 2.0.0 up to but not including 3.13.0. It involves improper handling of length parameters in BSON binary serialization, allowing an unauthenticated attacker who can supply binary data to manipulate database commands issued by the application. This can lead to unauthorized modification or disclosure of data within the scope of the application's database privileges. The issue is fixed in version 3.13.0.
The PEAK-System Device Driver Setup from HMS Networks contains a vulnerability due to improper handling of length parameters during a variable-length receive-record copy operation. The driver uses a requested or queued record count without adequately limiting the copy to the actual output buffer length provided by the caller. This can lead to an out-of-bounds write or similar memory corruption issues.
CVE-2026-87864 is a high-severity vulnerability in curl related to improper handling of length parameters when the CURLOPT_CRLF option is enabled. The flaw causes curl to advertise the raw byte count of input data in the IMAP APPEND command literal, while actually transmitting data with expanded line endings. This mismatch allows the server to read only the advertised byte count, leaving overflow bytes to be interpreted as additional IMAP commands within the authenticated session.
CVE-2026-101962 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper handling of length parameter inconsistency in processing BGP EVPN multicast updates, which can cause the rpd process to crash. This vulnerability does not impact confidentiality or integrity but results in denial of service due to process crash. Multiple versions of Junos OS and Junos OS Evolved are affected across various release streams. No known exploits in the wild have been reported. Patch status is not confirmed in the provided data; users should consult Juniper's official advisories for remediation guidance.
CVE-2026-92159 is a medium severity vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The issue involves improper handling of length parameters in the Svc::TlmPacketizer component, where a fixed-slot copy operation copies more data than the allocated channel slot size, causing adjacent channel fields to be overwritten and resulting in corrupted telemetry packets. This flaw is fixed in version 4.3.0.
CVE-2026-102054 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the L2ALM component. It involves improper handling of length parameter inconsistencies that allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory by sending VXLAN overlay-ping traffic to a local VTEP. The vulnerability does not impact confidentiality, integrity, or availability beyond limited information disclosure. Multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases are affected.
CVE-2026-101942 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper handling of length parameter inconsistencies in EVPN Type-3 or Type-4 routes. An unauthenticated network attacker can exploit this by sending malformed EVPN routes from a configured EVPN peer, causing a denial of service during route re-advertisement.
CVE-2026-101994 is a high-severity vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved. It involves improper handling of length parameter inconsistency in MC-LAG ICCP peer communications. An attacker who can control or impersonate a configured MC-LAG ICCP peer may exploit this flaw to disclose process heap memory or cause a denial of service via a malformed ICCP message.
CVE-2026-101991 is a low-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves improper handling of length parameter inconsistency in BGP-LS sessions with the traffic-engineering address family enabled. A configured BGP-LS peer can send a malformed UPDATE message that may cause heap data disclosure. The vulnerability does not impact integrity or availability and requires high attack complexity with no privileges and no user interaction.
IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability due to improper handling of malformed frames, which can cause a denial of service by terminating the host process. This issue is identified as CWE-130, involving length parameter inconsistency. The vulnerability has a high severity with a CVSS score of 7.5.
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift
nodejs and D lang bindings.
Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.
This issue affects Apache Thrift before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A vulnerability in Apache Thrift Dart bindings before version 0.25.0 allows memory allocation with an excessive size value due to improper handling of length parameter inconsistencies. This can lead to potential memory-related issues. The issue is fixed in version 0.25.0.
CVE-2026-85494 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves improper handling of length parameter inconsistencies leading to uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization across multiple language bindings. The issue is fixed in version 0.25.0.