https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:31:45 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-01893 bdu:2025-01893 https://cve.radiocsirt.org/vuln/bdu:2025-01893 https://cve.radiocsirt.org/vuln/bell-cve-2025-26466 <p><strong>Affected:</strong> Alpaquita:stream: openssh, BellSoft Hardened Containers:stream: openssh</p> <p><strong>Affected:</strong> Alpaquita:stream: openssh, BellSoft Hardened Containers:stream: openssh</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-26466 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0139 certfr-2025-avi-0139 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0139 https://cve.radiocsirt.org/vuln/euvd-2026-331246 EUVD-2026-331246 https://cve.radiocsirt.org/vuln/euvd-2026-331246 https://cve.radiocsirt.org/vuln/fkie_cve-2025-26466 <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-26466 https://cve.radiocsirt.org/vuln/ghsa-m92w-x6j2-5gc5 <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> https://cve.radiocsirt.org/vuln/ghsa-m92w-x6j2-5gc5 https://cve.radiocsirt.org/vuln/icsa-23-348-10 <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> https://cve.radiocsirt.org/vuln/icsa-23-348-10 https://cve.radiocsirt.org/vuln/msrc_cve-2025-26466 msrc_CVE-2025-26466 https://cve.radiocsirt.org/vuln/msrc_cve-2025-26466 https://cve.radiocsirt.org/vuln/oesa-2025-1314 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: openssh</p> <p>OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options. Security Fix(es):</p> <p>A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client&amp;apos;s memory resource first, turning the attack complexity high.(CVE-2025-26465)</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.(CVE-2025-26466)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: openssh</p> <p>OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options. Security Fix(es):</p> <p>A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client&amp;apos;s memory resource first, turning the attack complexity high.(CVE-2025-26465)</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.(CVE-2025-26466)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1314 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14820-1 <p>openssh-9.9p2-1.1 on GA media</p> <p>openssh-9.9p2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14820-1 https://cve.radiocsirt.org/vuln/suse-su-2025:0585-1 <p>Security update for openssh</p> <p>Security update for openssh</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0585-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-26466 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: openssh</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: openssh</p> <p>A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-26466 https://cve.radiocsirt.org/vuln/vde-2025-053 <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> <p>Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools</p> https://cve.radiocsirt.org/vuln/vde-2025-053 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0394 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um kryptografische Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0394