CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287

The libXpm library (versions before 3.5.19 ) is vulnerable to a denial of service due to an unsigned underflow in its write path. A local attacker can exploit this flaw to trigger unbounded CPU usage and memory exhaustion . No specific exploit information or in-the-wild exploitation details are p...

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library

Summary Multiple vulnerabilities related to Jackson Databind library were addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

PT-2026-99821

Name of the Vulnerable Software and Affected Versions libXpm versions prior to 3.5.19 Description An unsigned underflow in the write path of libXpm allows local attackers to trigger a denial of service. This condition can lead to unbounded CPU usage and memory exhaustion. Recommendations Update...

CVE-2026-102270: Inefficient Regular Expression Complexity

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

PT-2026-102362

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function is affected by a regular expression issue where lazy PEM processing causes extensive backtracking. This happens when input resembling a certificate contains repeated BEGIN...

PT-2026-108327

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is pem format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is pem...

CVE-2026-94287: Excessive Platform Resource Consumption within a Loop

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

PT-2026-102376

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.21 brace-expansion versions prior to 2.1.7 brace-expansion versions prior to 3.0.9 brace-expansion versions prior to 5.0.12 Description The expand function improperly handles untrusted patterns containing...

PT-2026-108332

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...

CVE-2026-102277: Uncontrolled Resource Consumption

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...

PT-2026-108348

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via excessive allocation. An attacker can exhaust system resources by sending...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in QpackUtil.decodePrefixedInteger, which places no bound on continuation bytes, unlike the HPACK decoder that stops at shift == 56, so an unterminated run returns -1 for buffer...

CVE-2026-100661

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100661

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

UBUNTU-CVE-2026-100661

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...