Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
CVE-2026-102726
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
#cwe-125
共收录 1565 条相关情报。
← 返回所有主题Out-of-bounds Read from Unvalidated MSRP Attribute List Length
CVE-2026-102725
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at...
CVE-2026-102721
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a p...
CVE-2026-102720
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte ...
CVE-2026-102718
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte resi...
CVE-2026-102714
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bo...
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the r...
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-lis
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_i...
CVE-2026-102711
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth cou...
CVE-2026-102560
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, t
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be trunc...
CVE-2026-102559
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size v
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame le...
CVE-2026-102558
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its inc
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(...
CVE-2026-102555
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL
CVE-2026-102726
CVE-2026-102726
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
CVE-2026-102725
CVE-2026-102725
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
CVE-2026-102721
CVE-2026-102721
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.
CVE-2026-102720
CVE-2026-102720
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the
CVE-2026-102718
CVE-2026-102718
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains
CVE-2026-102714
CVE-2026-102714
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.
CVE-2026-102713
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf