Ecosystem
Azure Linux
13,277 known vulnerabilities.
Most affected packages
4,316 results · Clear filters · Feed
-
High 8.1
HSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds cale…
-
High 8.1
IMAP APPEND plus CRLF conversion command injection
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted an…
-
High 8.1
HSTS cache import drops longer-lived child
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading …
-
High 8.1
server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the …
-
High 8.1
redirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
-
High 8.1
stale SigV4 headers sent unintended
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking sta…
-
High 7.8
virtualenv bash activate runs commands from an environment name with a backslash before $
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name conta…
-
High 7.1
virtualenv: Bash prompt values can change meaning under older compatibility modes
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subseq…
-
High 7.8
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains …
-
High 7.1
virtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH…
-
High 8.2
follow-redirects array-form headers bypass cross-origin credential stripping
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-d…
-
High 7.0
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buff…
-
High 7.1
Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-…
-
High 8.1
Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS …
-
High 8.1
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objec…
-
High 8.1
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these ar…
-
High 7.5
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for…
-
High 7.5
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not…
-
High 7.5
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference i…
-
High 7.5
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent…
-
High 8.1
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a U…
-
High 7.5
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unli…
-
High 7.5
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new sc…
-
High 8.2
AIOHTTP: File descriptor exhaustion in multipart requests
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptor…
-
High 8.2
aiohttp server lacks an initial request/header timeout
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request…
-
High 7.5
Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtg…
-
High 7.1
Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
-
High 7.5
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). Th…
-
High 7.5
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG") rejected duplicate/stale ACKs in …
-
High 8.1
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_op…
-
High 7.8
rds: ib: Clear the sg list when mapping an MR fails
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpi…
-
High 7.8
drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM nouveau_uvmm_sm() calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_…
-
High 7.8
drm/nouveau: fix double-free in nvif_vmm_dtor
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif_vmm_dtor On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear the client down. Then, nouveau_drm_open() also enters into its cleanup path and c…
-
High 7.8
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. INFO: task main:2354726 b…
-
High 7.1
HID: alps: fix use-after-free on input2 registration failure
In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() fre…
-
High 8.1CVE-2026-98499 Public exploit
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory r…
-
High 7.8
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of…
-
High 7.1
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0 even when address matching (IP6T_RT_FST_MASK) i…
-
High 7.5
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's sc…
-
High 7.1
KVM: SEV: Do cache maintenance on the source VM during intra-host migration
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in …