esa vulnerabilities

Products

• asn1scc 3
• pyesasky 1
• sleapi-j 1

Latest esa CVEs

Newest publication first

1. CVE-2026-76077 ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

   Published 2026-11-05

   High·CVSS 8.1 EPSS 0.38%

   ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and...

2. CVE-2026-75615 ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders

   Published 2026-11-05

   Medium·CVSS 5.3 EPSS 0.24%

   ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the ACN runtime function Acn_Dec_String_CharIndex_private in asn1crt/asn1crt_encoding_acn.c and the generated uPER decoder InternalItem_string_with_alpha_decode in StgC/uper_c.stg do not validate a d...

3. CVE-2026-75614 ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)

   Published 2026-11-05

   High·CVSS 8.1 EPSS 0.58%

   ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, BitStream_DecodeConstraintWholeNumber in asn1crt/asn1crt_encoding.c reads enough bits for a constrained integer but does not reject values above the declared range when the encoded range is not a pow...

4. CVE-2026-54086 SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

   Published 2026-10-13

   Medium·CVSS 5.3 EPSS 0.49%

   SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexp...

5. CVE-2022-30885 The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.

   Published 2022-06-24

   Critical·CVSS 9.8 EPSS 2.1%

   The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.