Microsoft Security Response Center

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ: Web-MQTT decompression bomb

RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

Out-of-bounds write in Das U-Boot

U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder

U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly

U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK

U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

Use-after-free of a server-side SSLContext when sni_callback switches contexts

SSLContext.wrap_bio() missing validation of server_hostname parameter

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Werkzeug safe_join() allows Windows special device names

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

virtualenv: Command injection via --prompt in activate.bat (batch activator)

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

Libsoup: libsoup: heap buffer overflow during websocket message reassembly

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

Integer Overflow or Wraparound and Out-of-bounds Write in compress

iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Timing Side-Channel in SM2 Signature Generation

QUIC Unvalidated Amplification Credit may be Over Accounted

QUIC Connection-Level Flow Control is Not Enforced for Streams

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Excessive Memory Allocation in Relative CRLDP Processing

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

NULL Pointer Dereference in CMP Client Revocation Response Handling

QUIC STREAM Fragment Metadata DoS

Microsoft Exchange Server Elevation of Privilege Vulnerability

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ: Admin path-traversal write via trace name

RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ: LDAP DN injection via unescaped substitution

RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ: Atom exhaustion: to_atom on global-parameter :name

RabbitMQ: Trust-store whitelist by Issuer+Serial only

RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

RabbitMQ: Web-STOMP unbounded pre-auth accumulation

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Axios: Header Injection via Inherited headers After Minimal Interceptor

sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

PyJWT accepts public JWK containers as HMAC secrets

PyJWT BOM Bypass

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv

roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

CRL check skipped when OCSP enabled and certificate has no OCSP URL

Heap use-after-free on read during bidirectional (D)TLS shutdown

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

Failed X509_verify_cert leaves unverified CA in shared CertManager

OCSP stapling v2 multi accepts non-CA chain certificates as issuers

Client session cache reference poisoning allows resumption with wrong server

Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Client accepts unsolicited RawPublicKey server certificate type

NameConstraints not enforced across unconstrained intermediate CA

Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.