CWE-617 vulnerabilities

CVE-2026-17427 is a vulnerability in IBM OPENBMC firmware versions FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82. It involves a reachable assertion due to improper validation of input length, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924.

In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503.

Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.

vLLM versions from 0.11.1 up to but not including 0.32.0 contain a reachable assertion vulnerability (CWE-617) in the image processing path. A remote client with access to the OpenAI-compatible API can submit a specific image whose normalized pixels sum to zero, triggering a fatal assertion that crashes the inference engine, causing denial of service for all users. This issue is resolved in version 0.32.0.

CVE-2026-102483 is a reachable assertion vulnerability in NTPsec ntpd versions 1.1.4 through 1.2.5. A remote attacker can cause the daemon to terminate by sending an NTS request containing excess NTS Cookie Placeholder extension fields. This results in a denial of service condition by crashing the ntpd process.

CVE-2026-97313 is a reachable assertion vulnerability in ISC BIND 9 that can cause the server to exit unexpectedly, resulting in a denial of service. The issue occurs when a recursive BIND server receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0), under specific configuration conditions involving RPZ zones. This affects BIND 9 versions from 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and certain S1 builds. The vulnerability requires the server to allow recursive queries and have at least two RPZ zones configured with differing "recursive-only" settings.

CVE-2026-96888 is a high-severity vulnerability in ISC BIND 9 affecting versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and their respective S1 variants. The issue occurs when a BIND resolver is configured with both a "redirect" zone and "qname-minimization strict" enabled, leading to an assertion failure and abort due to a NULL pointer dereference during redirect processing.

CVE-2026-82425 is a reachable assertion vulnerability in Apache bRPC versions prior to 1.18.0. It allows a malicious remote peer to cause a denial of service by crashing the process. The issue arises when a socket with health checking enabled is closed while an input event is still being processed, leading to a failed assertion and process termination. The vulnerability affects applications using bRPC clients with health check enabled. The issue is fixed in version 1.18.0.

CVE-2026-82210 is a reachable assertion vulnerability in Apache bRPC versions prior to 1.18.0. It occurs in the streaming feature when processing malformed stream feedback frames, allowing a remote unauthenticated attacker to crash the server process and cause a denial of service. The issue is fixed in version 1.18.0.

CVE-2026-78048 is a reachable assertion vulnerability in the HPACK header-compression decoder of the HTTP/2 stack in Apache bRPC versions prior to 1.18.0. An attacker can send a specially crafted sequence of HPACK headers to cause the server process to abort, resulting in a denial of service. The flaw arises from incorrect sizing of the dynamic table used for header compression, which leads to a buffer overflow condition triggering an assertion failure.

CVE-2026-56388 is a critical out-of-bounds write vulnerability in Apache bRPC's Redis server command parser. It occurs when the parser accepts an empty RESP array as a command header, allowing a remote unauthenticated attacker to cause a crash by sending a malformed command. The issue affects deployments with Redis service enabled that accept untrusted Redis protocol traffic. The vulnerability is fixed in Apache bRPC version 1.18.0.

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

CVE-2026-92160 is an integer overflow vulnerability in the nasa fprime framework prior to version 4.3.0. The flaw occurs in the Svc::FileDownlink SendPartial function where a wrapping sum bypasses file-range validation, causing the process to abort or reset and resulting in denial of service. This issue is fixed in version 4.3.0.

CVE-2026-101964 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent attacker can cause the rpd process to crash by sending a specially crafted Label Distribution Protocol (LDP) packet over an established LDP session. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium severity impact primarily due to availability disruption.

F Prime (F´) is a framework for spaceflight and embedded software applications. Versions prior to 4.2.0 have a vulnerability in the deserialization of file packets where an assertion can be triggered by an invalid file-packet type byte. This causes the application process to abort or reset, resulting in a denial of service. The issue is fixed in version 4.2.0.

CVE-2026-92150 is a reachable assertion vulnerability in the nasa fprime framework prior to version 4.2.0. The issue arises in the Svc::GenericHub fromBufferDriver_handler deserialization process, where externally influenced deserialization status and type validation use FW_ASSERT. This allows a command payload size subtraction to underflow. An unauthenticated inter-processor hub peer can send malformed hub traffic such as truncated buffers, invalid HubType, or header-only command-dispatch payloads, causing the process to abort or reset and resulting in denial of service. The vulnerability is fixed in version 4.2.0.

CVE-2026-101975 is a reachable assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent OSPF peer to cause a denial of service via OSPF traffic when OSPF Source Packet Routing best-route Prefix-SID installation is configured. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. Multiple versions of Junos OS and Junos OS Evolved are affected, spanning several release series. No known exploits are reported in the wild.

CVE-2026-92156 is a vulnerability in NASA's F Prime framework prior to version 4.3.0. It involves incorrect calculation of buffer size in the EventManager's log queue internal interface handler. The issue arises because EventManager accepts log buffers up to the maximum size but does not properly account for metadata overhead, leading to serialization failures and assertion triggers. This can cause a denial of service by aborting or resetting the process when a legal bridged event payload exceeds the remaining log-argument budget. The vulnerability is fixed in version 4.3.0.