CVE-2026-78667

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78669

A malicious HTTP/2 peer can trigger excessive CPU consumption in a client or server by opening numerous streams and transmitting many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This vulnerability impacts several packages, including loki , cloud-sql-proxy , kube-bench , ...

CVE-2026-78669

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

EUVD-2026-95426

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78669

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-78669

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

GO-2026-6609 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary fast-xml-parser is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-73569. Vulnerability Details CVEID:CVE-2026-73569 DESCRIPTION: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the path tokenizer in cairosvg/path.py, where the path function uses repeated string splitting on SVG path data, resulting in quadratic time complexity. An attacker can supply an SVG file containin...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-107696

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

UBUNTU-CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

UBUNTU-CVE-2026-107696

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

GHSA-3C6W-J9XM-8H2H Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...