← All credits

Discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research.

18 vulnerability records and advisories credit this contributor.

DTLS handshake reassembler allocates buffer from unchecked 24-bit length

AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

IesEngine stream-mode MAC forgery via length-dependent KDF split

CVE-2026-103601

CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

CVE-2026-103602

Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

CVE-2026-103603

Unbounded HSS public key level count allows huge array allocation during signature verification

CVE-2026-103604

Quadratic-time escaping when converting X.509 distinguished names to strings