CVE Vulnerability Catalog

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the Ember HTTP/2 server. An unauthenticated HTTP/2 client can send PING, SETTINGS, or DATA frames that cause the server to enqueue acknowledgments or WINDOW_UPDATE frames faster than they are written, leading to heap memory exhaustion.

In Http4s, the FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP therefore preserves credentials and transmits them over a plaintext connection.

In Http4s, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting.

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the shared WebSocket decoder. The decoder allows unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handshake can exhaust server memory.

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the DigestAuth server middleware. Due to an inverted stale-nonce comparison, the middleware does not remove fresh nonces and stops eviction at the first stale nonce. An unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory.

Http4s (Ember HTTP/1.1 module) prior to 0.23.35 and 1.0.0-M47 did not reject messages containing both Transfer-Encoding and Content-Length headers. This allows an intermediary and Ember to select different body framing rules, enabling HTTP request smuggling.

In Http4s, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base.

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session or in the browser of any visitor to a page using an Express Entry List block.

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-posting configuration, could import approved files of allowed types into the file manager.

Concrete CMS 9.0.0 to 9.5.2 dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type.

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list. An authenticated user with editor-level or higher privileges could submit a crafted search containing many single-character wildcards, forcing the database to perform a full-table scan and degrading responsiveness.

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, or deleted it without verifying edit_board_settings on the parent board. A user with board-edit rights on one board could reach instances of any other board.

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), allowing an authenticated dashboard user with view_express_entries on one entity to read entries of any other entity, including secret attribute values.

This CVE ID was rejected as a duplicate of CVE-2026-70496, which describes the same vulnerability. Use CVE-2026-70496 instead.

This CVE ID was rejected as a duplicate of CVE-2026-70495, which describes the same vulnerability. Use CVE-2026-70495 instead.

In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed.

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed.

In multiple functions of arm-smmu-v3.c, there is a logic error that may lead to privilege escalation. Exploitation requires local access and needs no user interaction or additional execution privileges.

In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed.

In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed.