Search CVE reports
1471 – 1480 of 37626 results
[Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable]
1 affected package
slurm-wlm
| Package | 26.04 LTS |
|---|---|
| slurm-wlm | Needs evaluation |
[Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames]
1 affected package
slurm-wlm
| Package | 26.04 LTS |
|---|---|
| slurm-wlm | Needs evaluation |
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of...
1 affected package
node-ajv
| Package | 26.04 LTS |
|---|---|
| node-ajv | Needs evaluation |
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established...
10 affected packages
golang-1.17, golang-1.20, golang-1.21, golang-1.22, golang-1.23...
| Package | 26.04 LTS |
|---|---|
| golang-1.17 | Not in release |
| golang-1.20 | Not in release |
| golang-1.21 | Not in release |
| golang-1.22 | Not in release |
| golang-1.23 | Needs evaluation |
| golang-1.24 | Needs evaluation |
| golang-1.25 | Needs evaluation |
| golang-1.26 | Needs evaluation |
| golang-1.27 | Not in release |
| golang-defaults | Needs evaluation |
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then,...
10 affected packages
golang-1.17, golang-1.20, golang-1.21, golang-1.22, golang-1.23...
| Package | 26.04 LTS |
|---|---|
| golang-1.17 | Not in release |
| golang-1.20 | Not in release |
| golang-1.21 | Not in release |
| golang-1.22 | Not in release |
| golang-1.23 | Needs evaluation |
| golang-1.24 | Needs evaluation |
| golang-1.25 | Needs evaluation |
| golang-1.26 | Needs evaluation |
| golang-1.27 | Not in release |
| golang-defaults | Needs evaluation |
Not in release
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes()...
1 affected package
python-httpx2
| Package | 26.04 LTS |
|---|---|
| python-httpx2 | Not in release |
Not in release
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss...
1 affected package
python-httpx2
| Package | 26.04 LTS |
|---|---|
| python-httpx2 | Not in release |
Not in release
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a...
1 affected package
python-httpx2
| Package | 26.04 LTS |
|---|---|
| python-httpx2 | Not in release |
Not in release
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files=...
1 affected package
python-httpx2
| Package | 26.04 LTS |
|---|---|
| python-httpx2 | Not in release |
Not in release
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an...
1 affected package
python-httpx2
| Package | 26.04 LTS |
|---|---|
| python-httpx2 | Not in release |