CVE-2026-86849

MediumCVSS 6.5/10Last modified Oct 15, 2026

Description

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatFast Datapath for RHEL 10—
Red HatFast Datapath for RHEL 10—
Red HatFast Datapath for RHEL 10—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 8—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatFast Datapath for RHEL 9—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenStack Platform 13 (Queens)—

References

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-86856.5The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and CVE-2026-868506.5The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions,CVE-2026-868516.5The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameCVE-2026-868534.3A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make CVE-2026-868566.5A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues arCVE-2026-868578.4ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-868588.7ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue cCVE-2026-868598.7ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-86869.1Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by seCVE-2026-868609.3ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could CVE-2026-868615.9pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.cCVE-2026-868626.5pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to
CVE-2026-86849: Medium severity, CVSS 6.5 | Vulnix