CVE-2026-55967

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-323

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-559687.5Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. T CVE-2026-559697.5Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache CVE-2026-55976.3A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the compon CVE-2026-559706.5Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to up CVE-2026-559719.8Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomme CVE-2026-559737.5In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) fr CVE-2026-559757.2A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certific CVE-2026-559769.1Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CVE-2026-559773.3Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting me CVE-2026-559788.4An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel CVE-2026-559795.2An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. CVE-2026-55987.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associat