30260 matches found
EUVD-2026-67072
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'...
GHSA-WW6M-CW3F-Q94G NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...
EUVD-2026-67073
NLTK: Quadratic CPU Exhaustion in XMLCorpusView.readxmlfragment...
GHSA-VP2X-QP44-57V7 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...
K000163180: BIND vulnerability CVE-2026-11605
Security Advisory Description The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG...
SUSE CVE-2026-74392
In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...
DoS (Denial of Service) immutable.js Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability known as CVE-2026-59880 was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...
SUSE CVE-2026-84305
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
CLSA-2026-1788335736 Fix of 13 CVEs
SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in addimpliedinclude from a files-from entry carrying both an interior and a trailing backslash: - debian/patches/els/0009-CVE-2026-70461.patch: count a trailing backslash when sizing the appended-wildcard pattern. - CVE-2026-70461...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...
DoS (Denial of Service) io.netty:netty-codec Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vect...
Allocation of Resources Without Limits or Throttling
Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. A...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings...
PT-2026-84844
Name of the Vulnerable Software and Affected Versions HTTPX2 versions 2.5.0 through 2.9.0 Description The Server-Sent Events SSE parser in src/httpx2/httpx2/ sse.py repeatedly copies and rescans buffered text within the SSELineDecoder.decode function when an SSE endpoint splits a single...
