Monthly
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Heap-exhaustion denial of service in the MLS implementation of Bouncy Castle for Java (bc-java) before 1.86, triggered by a single small PrivateMessage whose SenderData carries a wire-encoded uint32 leaf_index with its top bit set. Because that value is held in a signed int, it decodes as negative and passes the signed bounds checks in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove, letting a sender outside the tree reach LeafIndex.directPath()/NodeIndex.parent() arithmetic that never terminates at the tree root and grows a node list until the JVM runs out of heap. Impact is confined to availability (CVSS 4.0 8.7 with VA:H and no confidentiality or integrity effect); group membership is a practical prerequisite since the triggering MLS message or Remove proposal must originate from a current group participant, and applications that do not use org.bouncycastle.mls are unaffected. No public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in Bouncy Castle 1.86.
Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. Exploitation requires the device to be actively performing an NFS netboot and reaching the attacker-controlled server, so idle or non-NFS-boot devices are unaffected, and no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. A vendor patch exists (commit 0bbf0985, fixed in 2026.10-rc5) and no public exploit code was identified at time of analysis.
Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... BINARY, or binary-protocol parameters; no public exploit code has been identified at time of analysis. Vendor patches are available in MobilityDB v1.3.1 and v1.2.2.
Memory exhaustion in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library prior to 1.13.0 lets unauthenticated remote attackers who can influence an application's Qos settings make the client request an absurdly large prefetch limit and then buffer enough broker-delivered messages to exhaust host memory. Channel.Qos performs no bounds validation, so a negative prefetchCount or prefetchSize is cast straight into the uint16/uint32 fields of the basic.qos method and wraps to 65535 or 4294967295 instead of being rejected. The vendor CVSS 4.0 score of 8.2 (High) is availability-only and materially gated by the attack requirement that the embedding application accept untrusted Qos values; default usage with hard-coded, non-negative values is unaffected, and no public exploit code was identified at time of analysis. The defect is repaired in 1.13.0 via a new validateQos check.
Unauthenticated denial-of-service in MOOS core-moos through 10.4.0 allows remote attackers to crash the central MOOSDB process by sending a single crafted message containing a negative serialized string length value. The negative integer passes the existing arithmetic check in CMOOSMsg::operator>> but is then implicitly widened to an enormous size_t by string allocation routines, triggering an unhandled std::exception that escapes the server accept loop and terminates the MOOSDB process - halting all MOOS inter-process communication. No public exploit code or CISA KEV entry is confirmed, but the VulnCheck advisory and linked source code provide sufficient detail to reproduce the crash trivially.
A heap out-of-bounds write in Godot Engine through 4.7.2 is reachable when the engine (or an exported game built with it) loads a specially crafted binary resource file (.res). A negative Unicode-string length field read from the file bypasses the buffer-resize check and is then sign-extended into a very large unsigned copy count, causing file-controlled data to be written far past an undersized heap allocation. The attack is local and requires the victim to open a malicious .res file in the editor or to load it at runtime in a game that ingests external assets such as mods or user-supplied content, and reliable code execution demands heap grooming (high complexity); no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the supplier disputes the security relevance, arguing that loading untrusted resource files is outside Godot's threat model, whereas independent assessment rates the confidentiality, integrity and availability impact of a successful trigger as High.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Heap-exhaustion denial of service in the MLS implementation of Bouncy Castle for Java (bc-java) before 1.86, triggered by a single small PrivateMessage whose SenderData carries a wire-encoded uint32 leaf_index with its top bit set. Because that value is held in a signed int, it decodes as negative and passes the signed bounds checks in GroupKeySet.SecretTree.hasLeaf and Group.validateRemove, letting a sender outside the tree reach LeafIndex.directPath()/NodeIndex.parent() arithmetic that never terminates at the tree root and grows a node list until the JVM runs out of heap. Impact is confined to availability (CVSS 4.0 8.7 with VA:H and no confidentiality or integrity effect); group membership is a practical prerequisite since the triggering MLS message or Remove proposal must originate from a current group participant, and applications that do not use org.bouncycastle.mls are unaffected. No public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in Bouncy Castle 1.86.
Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. Exploitation requires the device to be actively performing an NFS netboot and reaching the attacker-controlled server, so idle or non-NFS-boot devices are unaffected, and no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. A vendor patch exists (commit 0bbf0985, fixed in 2026.10-rc5) and no public exploit code was identified at time of analysis.
Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... BINARY, or binary-protocol parameters; no public exploit code has been identified at time of analysis. Vendor patches are available in MobilityDB v1.3.1 and v1.2.2.
Memory exhaustion in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library prior to 1.13.0 lets unauthenticated remote attackers who can influence an application's Qos settings make the client request an absurdly large prefetch limit and then buffer enough broker-delivered messages to exhaust host memory. Channel.Qos performs no bounds validation, so a negative prefetchCount or prefetchSize is cast straight into the uint16/uint32 fields of the basic.qos method and wraps to 65535 or 4294967295 instead of being rejected. The vendor CVSS 4.0 score of 8.2 (High) is availability-only and materially gated by the attack requirement that the embedding application accept untrusted Qos values; default usage with hard-coded, non-negative values is unaffected, and no public exploit code was identified at time of analysis. The defect is repaired in 1.13.0 via a new validateQos check.
Unauthenticated denial-of-service in MOOS core-moos through 10.4.0 allows remote attackers to crash the central MOOSDB process by sending a single crafted message containing a negative serialized string length value. The negative integer passes the existing arithmetic check in CMOOSMsg::operator>> but is then implicitly widened to an enormous size_t by string allocation routines, triggering an unhandled std::exception that escapes the server accept loop and terminates the MOOSDB process - halting all MOOS inter-process communication. No public exploit code or CISA KEV entry is confirmed, but the VulnCheck advisory and linked source code provide sufficient detail to reproduce the crash trivially.
A heap out-of-bounds write in Godot Engine through 4.7.2 is reachable when the engine (or an exported game built with it) loads a specially crafted binary resource file (.res). A negative Unicode-string length field read from the file bypasses the buffer-resize check and is then sign-extended into a very large unsigned copy count, causing file-controlled data to be written far past an undersized heap allocation. The attack is local and requires the victim to open a malicious .res file in the editor or to load it at runtime in a game that ingests external assets such as mods or user-supplied content, and reliable code execution demands heap grooming (high complexity); no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the supplier disputes the security relevance, arguing that loading untrusted resource files is outside Godot's threat model, whereas independent assessment rates the confidentiality, integrity and availability impact of a successful trigger as High.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.