MAL-2025-15822 Malicious code in blitz-stream-convict-webdriverio (npm)

The package blitz-stream-convict-webdriverio was found to contain malicious code...

Malicious code in soundcloud-stream (npm)

The package soundcloud-stream was found to contain malicious code...

Malicious code in node-log-stream (npm)

The package node-log-stream was found to contain malicious code...

Malicious code in node-memory-stream (npm)

The package node-memory-stream was found to contain malicious code...

Malicious code in boson-csrf-accretion-stream (npm)

The package boson-csrf-accretion-stream was found to contain malicious code...

MAL-2025-21134 Malicious code in galaxy-stream-query-astrometry (npm)

The package galaxy-stream-query-astrometry was found to contain malicious code...

MAL-2025-23645 Malicious code in jasmine-stream-element-ui-config (npm)

The package jasmine-stream-element-ui-config was found to contain malicious code...

Malicious code in galaxy-stream-query-astrometry (npm)

The package galaxy-stream-query-astrometry was found to contain malicious code...

MAL-2025-27630 Malicious code in node-log-stream (npm)

The package node-log-stream was found to contain malicious code...

MAL-2025-33673 Malicious code in soundcloud-stream (npm)

The package soundcloud-stream was found to contain malicious code...

MAL-2025-20231 Malicious code in farout-stream-loglevel-sequelize (npm)

The package farout-stream-loglevel-sequelize was found to contain malicious code...

CVE-2025-20109

Improper Isolation or Compartmentalization in the stream cache mechanism for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-55197

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are...

CVE-2025-55197

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are...

CVE-2025-55197

The CVE-2025-55197 issue affects pypdf prior to version 6.0.0, where a crafted PDF using a sequence of FlateDecode filters in a malicious cross-reference stream can exhaust RAM (DoS). Other content streams may be affected on explicit access. The vulnerability has been fixed in 6.0.0. A workaround...

CVE-2025-55197 pypdf's Manipulated FlateDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are...

GHSA-PRJ3-CCX8-P6X4 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.” MadeYouReset Vulnerability Summary The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to brea...

tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames

A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream...

DEBIAN-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

ALPINE-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...