pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
CVE-2026-119196
## Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies
#advisory
共收录 22911 条相关情报。
← 返回所有主题pyasn1 has quadratic-complexity denial of service in binary REAL decoding
CVE-2026-119197
## Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
CVE-2026-119195
## Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
CVE-2026-119194
### Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
CVE-2026-118775
### Summary `asn1.oidToDer()` did not range-check the first two arcs of an OID string, so an OID such as `0.42.840.1135
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
CVE-2026-118777
### Summary The `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie
Forge: TLS client crash when the server sends no certificate
CVE-2026-118778
### Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malic
Forge: Regular expression denial of service in PEM decoding (pem.decode)
CVE-2026-118779
### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular express
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
CVE-2026-118781
### Summary `BigInteger.prototype.modInverse()` in node-forge's bundled jsbn library enters an infinite loop when the v
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
CVE-2026-118780
### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name,
Forge: AES-GCM authentication bypass via unvalidated tagLength option
CVE-2026-119186
### Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start(). With a tagLength
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
CVE-2026-118782
### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and t
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
CVE-2026-119188
### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` wh
Forge: Denial of service in TLS record processing via call stack exhaustion
CVE-2026-119187
### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one sta
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
CVE-2026-119190
### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConst
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling
CVE-2026-119193
### Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
CVE-2026-116794
### Summary The agent server in `russh::keys::agent::server` never calls `Agent::confirm` before signing with a key tha
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
CVE-2026-116775
## Summary `pageant::PageantStream` reads a 4-byte big-endian length prefix from its input stream and buffers until `le
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
CVE-2026-116774
## Summary A peer can advertise `maximum packet size = 0` in its channel-open message (`CHANNEL_OPEN` when attacking a
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
CVE-2026-116696
### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance