Bug 2565315 (CVE-2026-120440)
| Summary: | CVE-2026-120440 quickjs-ng: quickjs-ng: Denial of Service via memory leak in atomic store operations | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in QuickJS-NG. This vulnerability allows an attacker capable of running JavaScript code to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs when the JavaScript engine fails to release allocated memory upon encountering an error during atomic storage operations. By repeatedly executing these operations with manipulated memory buffers, an attacker can exhaust system memory, causing the application to crash or become unresponsive.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2568140, 2568142, 2568141 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-02 17:42:34 UTC
|