CVE-2026-0708

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

• CWE-125

• https://access.redhat.com/security/cve/CVE-2026-0708Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2427770Issue Tracking, Third Party Advisory
• https://github.com/vstakhov/libucl/issues/323Exploit, Issue Tracking, Vendor Advisory
• https://github.com/vstakhov/libucl/issues/323Exploit, Issue Tracking, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0701A vulnerability was identified in code-projects Intern Membe…7.2
• CVE-2026-0702The VidShop – Shoppable Videos for WooCommerce plugin for Wo…7.5
• CVE-2026-0703The NextMove Lite – Thank You Page for WooCommerce plugin fo…6.4
• CVE-2026-0704In affected version of Octopus Deploy it was possible to rem…9.1
• CVE-2026-0705Local privilege escalation due to insecure folder permission…6.7
• CVE-2026-0707A flaw was found in Keycloak. The Keycloak Authorization hea…5.3
• CVE-2026-0709Some Hikvision Wireless Access Points are vulnerable to auth…7.2
• CVE-2026-0710A flaw was found in SIPp. A remote attacker could exploit th…8.4
• CVE-2026-0711A post-authentication command injection vulnerability in the…6.8
• CVE-2026-0712Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-0713Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-0714A physical attack vulnerability exists in certain Moxa indus…6.8