Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: denial of service via automatic certificate authentication loop

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png

Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

fast-uri vulnerable to host confusion via failed IDN canonicalization

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Dracut: dracut: root code execution via dhcp options command injection

ASP.NET Core Denial of Service Vulnerability

Svelte devalue: DoS via sparse array deserialization

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Apache HTTP Server: mod_http2 denial of service

Apache HTTP Server: mod_xml2enc heap overflow

Apache HTTP Server: mod_proxy_html buffer overflow

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Invalid handling of CLASS != IN

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Crash during DNSSEC validation of malicious content

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

Long list of incoming EDNS options degrades performance

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

ws: Uninitialized memory disclosure

libyang: lyb_read_string() integer overflow → heap buffer overflow

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

ASP.NET Core Denial of Service Vulnerability

No description published yet

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input

DoS attack via DOMNode::C14N()

NULL pointer dereference in SOAP apache:Map decoder with missing <value>

Signed integer overflow in metaphone()

Quadratic string concatentation in consumeComment in net/mail

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

fast-uri vulnerable to path traversal via percent-encoded dot segments

Prometheus: remote read endpoint allows denial of service via crafted snappy payload