[rx_ip truncated DHCP options size_t underflow OOB read]

[TLS certificate notAfter validated against hardcoded 2025-01-01 string]

[mg_tls_client_recv_hello key_share extension OOB read]

[DNS transaction ID is sequential -- enables response injection]

[NDP RA allows any value for MTU]

[mg_tls_recv_cert certificate chain length unchecked -- OOB read]

[TLS certificate notAfter validated against hardcoded 2025-01-01 string]

[RSA-PSS CertificateVerify checks only 0xbc trailer]

[mg_der_to_tlv long-form DER length OOB read]

[mg_der_find_oid unbounded recursion on constructed DER tags]

[skip_chunk off-by-one OOB read in chunked HTTP CRLF check]

[mg_der_to_tlv long-form DER length OOB read]

[find_opt zero-length PPP option -- infinite loop]

[rx_ip6 IPv6 extension header OOB read; 16-bit len wrap]

[mg_tls_parse_cert_der pubkey BIT STRING length underflow -- OOB read]

[mg_tls_server_recv_hello session_id_len OOB read]

[precompute_slide_window NULL deref on OOM / more_comps NULL deref after failed calloc / bi_initialize / alloc NULL deref on OOM]

[MQTT v5 properties bounds check uses relative offset against absolute position]

[w5100_rx wraparound RX path copies n instead of r bytes]

(An issue in kamailio v.6.1.1 and before allows a remote attacker to ca ...)