Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
CVE-2026-94644
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
#msrc
共收录 2151 条相关情报。
← 返回所有主题selinux: preserve user SID across nested backing files
CVE-2026-98215
selinux: preserve user SID across nested backing files
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
CVE-2026-94657
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
net: bridge: mst: move switchdev call outside rcu
CVE-2026-98301
net: bridge: mst: move switchdev call outside rcu
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
CVE-2026-98176
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
CVE-2026-94633
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
CVE-2026-66331
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
ALSA: core: Fix potential UAF after asynchronous card release
CVE-2026-98266
ALSA: core: Fix potential UAF after asynchronous card release
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
CVE-2026-90440
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthen
wifi: cfg80211: ibss: ref BSS entry for joined event
CVE-2026-98338
wifi: cfg80211: ibss: ref BSS entry for joined event
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
CVE-2026-96289
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
wifi: mac80211: only operate on TDLS peers in the TDLS code
CVE-2026-98332
wifi: mac80211: only operate on TDLS peers in the TDLS code
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
CVE-2026-94638
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
dmaengine: Fix device kref underflow in dma_chan_put()
CVE-2026-98344
dmaengine: Fix device kref underflow in dma_chan_put()
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
CVE-2026-94653
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
wifi: mac80211: mesh: reset the CSA state when leaving
CVE-2026-98327
wifi: mac80211: mesh: reset the CSA state when leaving
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
CVE-2026-86537
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to den
mmc: mxcmmc: cancel data work and watchdog on remove
CVE-2026-98210
mmc: mxcmmc: cancel data work and watchdog on remove
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
CVE-2026-66081
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
btrfs: handle lack of space when cleaning up verity items
CVE-2026-98279
btrfs: handle lack of space when cleaning up verity items