A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctpdestroysock is called without socknet(sk)->sctp.addrwqlock then an element is removed from the autoasconfsplist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPFCGROUPINETSOCKCREATE is attached which denies creation of some SCTP socket.

GNU Binutils before 2.34 has a NULL pointer dereference in bfdpefparsefunctionstubs function in bfd/pef.c due to not checking return value of bfdmalloc. This bug allows attackers to cause a denial of service.

Reference: https://sourceware.org/bugzilla/showbug.cgi?id=25308

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

A flaw was found in Apache HTTP Server (httpd) versions 2.4.0 to 2.4.41. Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirected instead to an unexpected URL within the request URL.