massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

CVE-2026-126360

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace...

CVE-2026-126360: open-telemetry opentelemetry-python: OpenTelemetry Python provides the Python API and SDK for OpenTelemetry

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace...

EUVD-2026-124678

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

EUVD-2026-123607

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

CVE-2026-119237

The proxygen HTTP/3 session is vulnerable to a Denial of Service (DoS) attack in versions prior to v2026.11.09.00 . When a HEADERS block references QPACK dynamic table entries that have not been received, header decoding pauses while the session continues to read from the QUIC transport. This all...

CVE-2026-119237

In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit,...

EUVD-2026-123604

mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC pee...

CVE-2026-119234

mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC pee...

CVE-2026-119233

The proxygen HTTP/3 codec is vulnerable to a denial of service due to how it handles incomplete non-DATA frames (such as control-stream frames, unknown types, or HEADERS frames). The root cause is that the codec buffers these frames until their entire declared length is received without imposing ...

EUVD-2026-123603

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

Security update for containerd

This update for containerd fixes the following issues: CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP response body reading bsc1274214. CVE-2026-47262: Denial of Service DoS condition via a maliciously crafted image bsc1268441...

bind: BIND: Denial of Service via unbounded processing of crafted DNS messages

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...

bind: BIND: Denial of Service via unbounded processing of crafted DNS messages

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System DNS protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious reque...

PT-2026-145268

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...