CVE-2026-102834
HighCVSS 7.5Summary
JavaCV prior to 1.5.14 has IPCameraFrameGrabber doubling a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. A malicious MJPEG camera endpoint can return an oversized Content-Length header, trapping the frame-grabbing thread in a CPU-spinning loop and causing denial of service.
Risk Assessment
An application consuming MJPEG streams from untrusted cameras can be locked up by a permanent CPU-spinning loop, preventing further image processing.
Recommendation
Update JavaCV to version 1.5.14 or later and avoid consuming MJPEG streams from untrusted sources.
Related vulnerabilities
- CVE-2026-78162Critical
A deserialization of untrusted data vulnerability in Apache Camel affects the camel-hazelcast component. Two configuration paths (ReplicatedHazelcastAggregationRepository and client mode in HazelcastDefaultComponent) fail to apply the JavaSerializationFilterConfig, allowing an attacker to achieve remote code execution by injecting a malicious Java object into the Hazelcast cluster.
- CVE-2026-111406Critical
The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.
- CVE-2026-110887Critical
The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.
- CVE-2026-103091Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.
- CVE-2026-102503Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.
- CVE-2026-108983Critical
A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.
- CVE-2026-111998Critical
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- CVE-2026-110886Critical
The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.
- CVE-2026-110372Critical
The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-109894Critical
The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.
Original NVD description (English source)
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS