EUVD-2026-58049

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455

CVE-2026-70455 concerns rsync 3.4.2 before 3.5.0. The vulnerability allows a remote sender to exhaust resources (threads/memory) by using the --zt alias for --compress-threads, which bypasses the refuse options directive’s matching on long option names. Attackers can set --zt=N with large N to sp...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-77)

Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker...

PT-2026-71859

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper management of thread authority swaps may allow a local attacker to gain elevated privileges. Recommendations Update IBM i versions 7.3 through 7.6 to a version that contains the fix for this...

PT-2026-71794

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw allows a low-privileged authenticated user with indexing permissions to submit a small document containing crafted input. Processing this document occupies a worker thread from a...

PT-2026-71762

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion occurs when a program continues to call a function without a proper termination condition. In this case, an authenticated user with read privileges on a single...

PT-2026-71655

Name of the Vulnerable Software and Affected Versions rsync versions 3.4.2 through 3.4.x Description A denial of service issue exists where a remote sender can exhaust system resources on the receiver. This occurs because the short alias --zt for the --compress-threads option bypasses the string...

CVE-2026-70455: Allocation of Resources Without Limits or Throttling

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

Linux Distros Unpatched Vulnerability : CVE-2026-48802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessa...

CVE-2026-18101: Improper Privilege Management

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps...

Linux kernel Thread Locking DoS

The vulnerability of the Linux operating system’s kernel is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-68334

A flaw was found in the Linux kernel's rxrpc component. A race condition in the rxrpcwakeupiothread function could lead to a null pointer dereference. This occurs when the iothread pointer is checked and then reloaded, and if the I/O thread exits between these operations, the second load can resu...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

Linux Distros Unpatched Vulnerability : CVE-2026-68334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread...

SUSE CVE-2026-68319

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...