Most recent entries from all

bdu:2026-09107

2026-10-03T21:21:34.739181+00:00

bdu:2026-09107

certfr-2026-avi-0788 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-03T21:21:34.739242+00:00

certfr-2026-avi-0788

CLEANSTART-2026-FR90298 — Security fix for CVE-2026-44289 applied in: azure-functions-node 4.1052.200-r0, jitsucom-jitsu 2.14.0-r1

2026-10-03T21:21:34.739288+00:00

Affected: CleanStart: azure-functions-node, CleanStart: jitsucom-jitsu

CVE-2026-44289 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-361082

2026-10-03T21:21:34.739325+00:00

EUVD-2026-361082

fkie_cve-2026-44289

2026-10-03T21:21:34.739338+00:00

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

GHSA-685m-2w69-288q — protobuf.js: Denial of service through unbounded protobuf recursion

2026-10-03T21:21:34.739370+00:00

Affected: npm: protobufjs

## Summary

protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields.

A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding.

## Impact

An attacker who can provide protobuf binary data decoded by an application may be able to crash the process or otherwise cause decoding to fail with a stack overflow.

This affects applications that decode untrusted protobuf binary input with affected versions.

## Preconditions

- The application must decode protobuf binary data influenced by an attacker. - The crafted input must contain deeply nested protobuf structures, such as nested group tags or nested message fields. - The affected decoder path must process the crafted input.

## Workarounds

Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.

RHSA-2026:42815 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update

2026-10-03T21:21:34.739405+00:00

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs: protobufjs: Denial of Service via crafted schema protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs: protobufjs: Denial of Service via crafted JSON descriptors linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution tar: node-tar: Denial of Service via crafted gzip bomb tar: Node-tar: Denial of Service via malformed tar archive header

WID-SEC-W-2026-2452 — Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere S…

2026-10-03T21:21:34.739443+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.