RLSA-2026:80504 Important: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU...

OPENSUSE-SU-2026:22093-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

BIT-GHOST-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

BIT-GHOST-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-21978

CVE-2026-21978 My CVE in Oracle FLEXCUBE Universal Banking Link: https://www.oracle.com/security-alerts/cpujan2026.html...

CLEANSTART-2026-HC65345 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CVE-2026-110249: Undefined Security Weakness

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:4625-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4625-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...

PT-2026-111345

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

PT-2026-111380

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF affected versions not specified Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read...

microcode_ctl security, bug fix, and enhancement update

20260812-1.0.2 - disable late update for 06-ad-01 20260812-1.0.1 - enable use with ueknext and UEK8 kernels - don't bother calling dracut if virtualized - ensure UEK also rebuilds initramfs - enable early update for 06-4f-01 - enable early and late load on RHCK 4:20260812-1 - Update Intel CPU...

Security Vulnerabilities fixed in Thunderbird 153.5 — Mozilla

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours...

Ubuntu 24.04 LTS / 26.04 LTS : zlib vulnerability (USN-8706-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8706-1 advisory. It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the applyNaive function in pkg/archive/tar.go, where each .wh..wh..opq entry triggers a full filepath.Walk of the containing directory with no record of directories already process...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the applyNaive function in pkg/archive/tar.go, where each .wh..wh..opq entry triggers a full filepath.Walk of the containing directory with no record of directories already process...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

The cbor-sync library, versions through 1.0.4 , is vulnerable to a resource exhaustion attack within the CBOR.decode function. The root cause is that the component trusts declared array and map lengths without verifying the remaining input. An attacker can provide a small, crafted CBOR payload wi...

CVE-2020-37280 cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...