43 matches found
EUVD-2026-91056
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...
Security Bulletin: Due to the use of jackson-databind, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-68497)
Summary Jackson-databind is used by IBM Sterling Control Center as part of dependency in jackson-databind-2.17.1.jar Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by...
Allocation of Resources Without Limits or Throttling
Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java. An attacker can force excessive CPU work by supplying a...
Allocation of Resources Without Limits or Throttling
Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182
The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
BIT-RABBITMQ-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...
GHSA-CXP5-3PX4-PW24 jackson-databind quadratic forward-reference completion
Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...
EUVD-2026-85003
jackson-databind quadratic forward-reference completion...
jackson-databind quadratic forward-reference completion
Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...
DEBIAN-CVE-2026-67419
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...
CVE-2026-67419
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...
CVE-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...
CVE-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...
CVE-2026-67419
Prior to version 4.3.5 , RabbitMQ is vulnerable to a flaw where an authenticated user can trigger combinatorial CPU work and memory pressure. By binding a queue to a topic exchange and publishing a message with consecutive # segments in a binding key, the attacker forces topic matchers to revisit...
CVE-2026-67419: Inefficient Algorithmic Complexity
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...