early signals oss-security infra

Godot 4.x: remote client crash via multiplayer spawn packet sync_len overflow

// AI summary

Godot 4.x versions from 4.0.0 through 4.7.2 and current master have a remote denial-of-service vulnerability via a spawn packet sync_len overflow.

// from the source

Posted by Tomasz Kaye on Oct 27 A remote denial-of-service vulnerability in Godot 4.x multiplayer was publicly disclosed on 2026-10-27 [1]. Affected versions: Godot 4.0.0 through 4.7.2 and current master (vulnerable check introduced in commit 32a62af648, 2022-10-03). Runtime-confirmed on the official 4.7-stable Windows binary. Description: The spawn-packet bounds check in SceneReplicationInterface::on_spawn_receive (modules/multiplayer/scene_replication_interface.cpp:586)...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org