CVE-2026-10722Medium· 5.5▾ SunlitA flaw was found in the cilium/ebpf Go library (versions up to 0.21.0). An integer overflow in the loadRawSpec function (btf/btf.go) when parsing BTF collection specs can cause excessive memory allocation or parsing failure. A local attack…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
3.3 → 5.5
low → medium
A flaw was found in the cilium/ebpf Go library (versions up to 0.21.0). An integer overflow in the loadRawSpec function (btf/btf.go) when parsing BTF collection specs can cause excessive memory allocation or parsing failure. A local attacker who can supply a crafted eBPF collection spec to an application using this library could trigger a denial of service.
github.com/cilium/ebpf: Cilium ebpf: Denial of Service via integer overflow — rated Moderate by Red Hat. Released 2026-06-03, updated 2026-10-23.
Affected:
No fix planned:
Fix deferred
Affected packages:
github.com/cilium/ebpf < 0.22.0Patched in:
github.com/cilium/ebpf 0.22.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39834Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)
CVE-2025-4673Medium· 6.8net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)
CVE-2026-110036Low· 3.3A flaw was found in device-mapper-persistent-data
CVE-2021-33194High· 7.5golang: x/net/html: infinite loop in ParseFragment (CVE-2021-33194)
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)