CVE-2026-82743

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

EUVD-2026-68948

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

SUSE CVE-2026-72151

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpmbufappendsalt tpmbufappendsalt in drivers/char/tpm/tpm2-sessions.c calls cryptokppgeneratepublickey and cryptokppcomputesharedsecret without installing a completion callback...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

ROOT-APP-NPM-CVE-2021-43138 CVE-2021-43138 in async - Patched by Root

Root has patched CVE-2021-43138 in the async package for Root:npm. Multiple fixed versions available...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the fileFilter parameter. An attacker can upload files exceeding the intended size limit by exploiting a race condition when asynchronous filtering is used together with file size restrictions. Remediation Upgrade mult...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001482)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001482 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async PF workqueue when vCPU is being destroyed Always flush the per-vCPU asyn...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001418)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001418 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open Yang Erkun reports that when two...

CVE-2026-77063

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

CVE-2026-77063

multer , a Node.js middleware for handling multipart/form-data, contains a race condition in its file stream handling that is triggered when an application uses an asynchronous fileFilter together with the fileSize limit . An attacker can exploit this to cause a file that exceeds the configured s...

vamp-forticheck

vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...

SUSE CVE-2026-72077

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

PT-2026-83357

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description A race condition exists in the file stream handling when an application utilizes an asynchronous fileFilter in conjunction with the fileSize limit. This allows files that exceed the configured size...

CVE-2026-59324

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...