Threats Tagged 'cwe-833'

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be triggered by an unprivileged local user and can result in kernel panic or deadlock.

CVE-2026-39830 is a critical vulnerability in the golang. org/x/crypto/ssh package where a malicious SSH peer can send unsolicited global request responses that fill an internal buffer, causing the connection's read loop to block. This deadlock prevents the blocked goroutine from being released even when Close() is called, leading to a resource leak for each affected connection. The vulnerability is identified as CWE-833 (Deadlock). No official patch or remediation level is currently provided, and no known exploits are reported in the wild.

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.

Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects smartLink HW-PN: from 1.02 through 1.03 smartLink HW-DP: 1.31

HighVulnerabilityGermanyFranceItaly+3#cve#cve-2025-10150#cwe-833

An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.

MediumVulnerabilityGermanyFranceItaly+4#cve#cve-2025-59463#cwe-833

Windows Security Account Manager (SAM) Denial of Service Vulnerability

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-54796#cwe-400

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) : * Devolutions Server 2025.2.2.0 through 2025.2.5.0 * Devolutions Server 2025.1.12.0 and earlier

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-8312#cwe-833

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-36010#cwe-833