Veille CVE

Vendredi 25 septembre 2026

5 CVE

Critique 0 Élevée 4 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « coder » ✕
  1. CVE-2026-97325 4.3 Moyenne

    YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro

    A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

  2. CVE-2026-93575 7.5 Élevée

    Red Hat AMQ Broker 7 · Red Hat build of Apache Camel for Spring Boot 4 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform 7

    A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.

  3. CVE-2026-93572 7.5 Élevée

    Red Hat build of Apache Camel for Spring Boot 4 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat Single Sign-On 7

    A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.

  4. CVE-2026-93563 7.5 Élevée

    Red Hat build of Apache Camel for Spring Boot 4 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat Single Sign-On 7

    A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.

  5. CVE-2026-93494 7.5 Élevée

    Red Hat build of Apache Camel for Spring Boot 4 · Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat Single Sign-On 7

    A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.