CVE-2018-19591
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation o
CVSS
7.5
Alto
EPSS
5.5%
p93
KEV
—
Exploit Today
28
0-100
Publicado: 4 dic 2018 · Última mod.: 14 oct 2026 · CWE-20 · CWE-404
5.5%EPSS · 30 días5.5%
2026-10-062026-11-03
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
- www.securityfocus.comhttp://www.securityfocus.com/bid/106037
- www.securitytracker.comhttp://www.securitytracker.com/id/1042174
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/
- security.gentoo.orghttps://security.gentoo.org/glsa/201903-09
- security.gentoo.orghttps://security.gentoo.org/glsa/201908-06
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190321-0003/
- sourceware.orghttps://sourceware.org/bugzilla/show_bug.cgi?id=23927
- sourceware.orghttps://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD
- sourceware.orghttps://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408
- usn.ubuntu.comhttps://usn.ubuntu.com/4416-1/
- www.securityfocus.comhttp://www.securityfocus.com/bid/106037
- www.securitytracker.comhttp://www.securitytracker.com/id/1042174
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/
- security.gentoo.orghttps://security.gentoo.org/glsa/201903-09
- security.gentoo.orghttps://security.gentoo.org/glsa/201908-06
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190321-0003/
- sourceware.orghttps://sourceware.org/bugzilla/show_bug.cgi?id=23927
- sourceware.orghttps://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-108946——
——0Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows:
* an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check.
* a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription
* a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.1hCVE-2026-108500——
——0Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.
This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.1hCVE-2026-111821——
——0Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.2hCVE-2026-794057.5 ALT—
——0In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed.8hCVE-2026-1166546.5 MED—
——0Tanium addressed an improper input validation vulnerability in Threat Response.13hCVE-2026-1166534.3 MED—
——0Tanium addressed an improper input validation vulnerability in Threat Response.13h