Ecosystem
Azure Linux
13,277 known vulnerabilities.
Most affected packages
13,257 results · Feed
-
High 7.8
virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh scri…
-
High 7.5CVE-2026-102253 Public exploit
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter messa…
-
Medium 5.9CVE-2026-12345 Public exploit
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permiss…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap b…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer o…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame …
-
High 8.2
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length…
-
Medium 6.5
Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails t…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation …
-
High 8.6
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the do…
-
Medium 5.9
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap …
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
-
High 7.5
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every…
-
High 8.2
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…
-
Low 3.7
Timing Side-Channel in SM2 Signature Generation
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over man…
-
Medium 5.3
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacke…
-
Medium 5.3
NULL Pointer Dereference in CMP Client Revocation Response Handling
Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a rea…
-
Medium 5.3
QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connectio…
-
High 7.5
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms…
-
Low 3.7
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access…
-
High 7.5
QUIC STREAM Fragment Metadata DoS
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for pac…
-
Low 3.7
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to me…
-
Medium 5.3
Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream d…
-
Low 3.7
QUIC Unvalidated Amplification Credit may be Over Accounted
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplificatio…
-
Medium 5.3
Excessive Memory Allocation in Relative CRLDP Processing
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memo…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…
-
Medium 6.3
Werkzeug safe_join() allows Windows special device names
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker.…
-
High 7.5
Integer Overflow or Wraparound and Out-of-bounds Write in compress
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding Max…
-
High 7.1
Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one…
-
Critical 9.0
Out-of-bounds write in Das U-Boot
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was f…
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Missing Release of Memory after Effective Lifetime in Wireshark
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
High 8.1
Heap-based Buffer Overflow in Wireshark
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Unchecked Input for Loop Condition in Wireshark
Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 4.7
Heap-based Buffer Overflow in Wireshark
CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Buffer Over-read in Wireshark
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Heap-based Buffer Overflow in Wireshark
Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Reachable Assertion in Wireshark
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Improperly Controlled Sequential Memory Allocation in Wireshark
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
Heap-based Buffer Overflow in Wireshark
RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service