IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.5Yüksek

CVE-2026-87742Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Exploit Intelligence; Red Hat Red Hat Enterprise Linux AI (RH… Yayım: (1 ay önce)

Açıklama

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Zayıflık türü (CWE): CWE-770

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
quarkus 3.27 —
quarkus 3.33 —
Red Hat Exploit Intelligence all versions
Red Hat Red Hat build of Quarkus 3.27.5.SP2 —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 —
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions

Kaynaklar ve yamalar

Aynı üründe son açıklar — Red Hat Enterprise Linux

5.5Orta
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…