Threats Tagged 'cwe-681'

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

CVE-2026-21069 is a medium severity vulnerability in Samsung Mobile Devices involving an incorrect conversion between numeric types in the VC1 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the Samsung Mobile SMR August 2026 Release 1. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-55768 is a high-severity vulnerability in the GoAccess real-time web log analyzer prior to version 1.11. It involves improper handling of WebSocket frame lengths, where a 64-bit extended frame length is narrowed to a signed 32-bit field without proper enforcement, allowing an unauthenticated remote attacker to trigger an excessive memory allocation of approximately 18 exabytes. This causes the process to terminate unexpectedly. The issue is fixed in GoAccess version 1.11.