Vulnerabilidades de la pila Sistemas operativos · Página 53

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll ba

• Actualiza a 1.14.0

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does n

• Actualiza a 1.14.0

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream fo

• Actualiza a 1.14.0

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop t

• Actualiza a 1.14.0

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.

• Actualiza a 1.14.0

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk

• Actualiza a 1.14.0

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte fram

• Actualiza a 1.14.0

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream

• Actualiza a 1.14.0

Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

• Actualiza a 3.6
• Actualiza a 3.6-1

Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

• Actualiza a 24.0.0

Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

• Actualiza a 23.0.4

Security update for cifs-utils

This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).

• Actualiza a 7.4-160000.3.1

Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

Important: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * container-tools:rhel8: buildah RPM has the wrong version (JIRA:Rocky Linux-272014) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References s

• Actualiza a 0:84.1-1.module+el8.10.0+1815+5fe7415e
• Actualiza a 0:84.1-1.module+el8.10.0+1948+4b5cd4a9
• Actualiza a 0:84.1-1.module+el8.10.0+2001+6a33db9f
• Actualiza a 0:84.1-1.module+el8.10.0+40047+0c0a73f4
• Actualiza a 0:84.1-1.module+el8.10.0+40133+32c21f88
• Actualiza a 2:1.10.1-2.module+el8.10.0+1874+ce489889
• Actualiza a 2:1.10.1-2.module+el8.10.0+1880+8e896d1b
• Actualiza a 2:1.10.1-2.module+el8.10.0+1896+b18fa106
• Actualiza a 2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9
• Actualiza a 2:1.10.1-2.module+el8.10.0+2001+6a33db9f
• Actualiza a 2:1.10.1-2.module+el8.10.0+40047+0c0a73f4
• Actualiza a 2:1.10.1-2.module+el8.10.0+40133+32c21f88

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: net/sched: serializ

• Actualiza a 0:4.18.0-553.178.1.el8_10

libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow

A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

libimobiledevice AFC File afc.c afc_file_open out-of-bounds

A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

libimobiledevice AFC Service afc.c service_receive double free

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Security update for gcc7

This update for gcc7 fixes the following issues: - CVE-2026-95619: libstdc++ integer overflow in `new` operator (bsc#1282500). - CVE-2026-102010: UAF due to improper pointer update when an application calls the `erase_if` function on a binary heap priority queue in `libstdc++` (bsc#1283123).

• Actualiza a 7.5.0+r278197-150000.4.49.1