https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:39:17 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07985 bdu:2026-07985 https://cve.radiocsirt.org/vuln/bdu:2026-07985 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed59299 <p><strong>Affected:</strong> CleanStart: stargate</p> <p>Security vulnerability affects the stargate package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: stargate</p> <p>Security vulnerability affects the stargate package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ed59299 https://cve.radiocsirt.org/vuln/euvd-2026-264832 EUVD-2026-264832 https://cve.radiocsirt.org/vuln/euvd-2026-264832 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21452 <p>MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes…</p> <p>MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21452 https://cve.radiocsirt.org/vuln/ghsa-cw39-r4h6-8j3x <p><strong>Affected:</strong> Maven: org.msgpack:msgpack-core</p> <p>### Summary Affected Components: ``` org.msgpack.core.MessageUnpacker.readPayload() org.msgpack.core.MessageUnpacker.unpackValue() org.msgpack.value.ExtensionValue.getData() ``` A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation.</p> <p>### PoC ``` import msgpack import struct import os</p> <p>OUTPUT_DIR = &#34;bombs&#34; os.makedirs(OUTPUT_DIR, exist_ok=True)</p> <p># EXT format: fixext / ext8 / ext16 / ext32 # ext32 allows attacker-controlled length (uint32)</p> <p>length = 1 step = 10_000_000</p> <p>while True: try: # EXT32: 0xC9 | length (4 bytes) | type (1 byte) header = b&#39;\xC9&#39; + struct.pack(&#34;&gt;I&#34;, length) + b&#39;\x01&#39; payload = b&#39;A&#39; # actual data tiny</p> <p>data = header + payload</p> <p>fname = f&#34;{OUTPUT_DIR}/ext_length_{length}.msgpack&#34; with open(fname,…</p> <p><strong>Affected:</strong> Maven: org.msgpack:msgpack-core</p> <p>### Summary Affected Components: ``` org.msgpack.core.MessageUnpacker.readPayload() org.msgpack.core.MessageUnpacker.unpackValue() org.msgpack.value.ExtensionValue.getData() ``` A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation.</p> <p>### PoC ``` import msgpack import struct import os</p> <p>OUTPUT_DIR = &#34;bombs&#34; os.makedirs(OUTPUT_DIR, exist_ok=True)</p> <p># EXT format: fixext / ext8 / ext16 / ext32 # ext32 allows attacker-controlled length (uint32)</p> <p>length = 1 step = 10_000_000</p> <p>while True: try: # EXT32: 0xC9 | length (4 bytes) | type (1 byte) header = b&#39;\xC9&#39; + struct.pack(&#34;&gt;I&#34;, length) + b&#39;\x01&#39; payload = b&#39;A&#39; # actual data tiny</p> <p>data = header + payload</p> <p>fname = f&#34;{OUTPUT_DIR}/ext_length_{length}.msgpack&#34; with open(fname,…</p> https://cve.radiocsirt.org/vuln/ghsa-cw39-r4h6-8j3x https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21452 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: msgpack-java, Ubuntu:22.04:LTS: msgpack-java, Ubuntu:24.04:LTS: msgpack-java, Ubuntu:25.10: msgpack-java, Ubuntu:26.04:LTS: msgpack-java</p> <p>MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes…</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: msgpack-java, Ubuntu:22.04:LTS: msgpack-java, Ubuntu:24.04:LTS: msgpack-java, Ubuntu:25.10: msgpack-java, Ubuntu:26.04:LTS: msgpack-java</p> <p>MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21452 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1194 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1194