Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...

Allocation of Resources Without Limits or Throttling

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the appearance stream rendering loop in appearancestream.py, where...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the groupcomments function to repeatedly rescan these statements, leading to...

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit a vulnerability in the TokenList construction and string conversion processes, specifically when handling nested token subtrees. This flaw leads to quadratic CPU consumption, which can result in a Denia...

sqlparse: sqlparse: Denial of Service via inefficient SQL parsing

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input. This flaw causes inefficient processing of certain SQL patterns, leading to excessive CPU consumption and potentially a Denial of Service DoS...

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking vulnerability discovered by ? in WordPress Npm basic-ftp versions = 6.2.0...

EUVD-2026-90360

basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking...

Allocation of Resources Without Limits or Throttling

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in HTTPServerRequest.init in tornado/httputil.py via query strings with a...

USN-8861-1: OpenSSL vulnerabilities

It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. CVE-2026-42772 It was discovered that OpenSSL did not properly...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to inefficient handling of large or invalid ranges in disposition frames, which allows an authenticated attacker to cause excessive CPU consumption and trigger a denial-of-service condition...

Regular Expression Denial Of Service

Axios is vulnerable to a Regular Expression Denial Of Service. The vulnerability is due to quadratic backtracking in the regular expression used by shouldBypassProxy, where the pattern hostname.replace/\.+$/, '' scans a hostname composed of many dots followed by a non‑dot character, and an...

BIT-RABBITMQ-2026-67419 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...

BIT-RABBITMQ-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

BIT-RABBITMQ-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

BIT-PGBOUNCER-2026-6669 Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

CLEANSTART-2026-WP33718 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-EP02666 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the cri-tools package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-YT99957 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Security vulnerability affects the cri-tools package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CLEANSTART-2026-RV93629 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

CVE-2026-39820 affects multiple packages. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...