29092 matches found
CLEANSTART-2026-FO54280 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
PT-2026-108125
Name of the Vulnerable Software and Affected Versions CairoSVG versions prior to 2.9.1 Description Rendering an attacker-controlled SVG containing a path with many segments can lead to quadratic CPU consumption. This occurs due to two issues in cairosvg/path.py: the path tokenizer repeatedly slic...
CVE-2026-107678: Uncontrolled Recursion
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...
CVE-2026-107696: Loop with Unreachable Exit Condition
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects...
PT-2026-108032
Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.6 Pydantic AI versions prior to 2.52.0 Description The local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during the conversion of HTML to Markdown. This occurs...
CVE-2026-107297: Inefficient Algorithmic Complexity
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
CVE-2026-78667: Allocation of Resources Without Limits or Throttling
When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...
PT-2026-109279
Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.x Description An issue exists in the JSON response body processor where the ProcessResponse function in internal/bodyprocessors/json.go fails to enforce a recursion limit. It passes a value of -1 to...
PT-2026-108057
Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk of data arrives. A remote peer can exploit this by splitting a single valid MessagePack container...
CVE-2026-105830: Uncontrolled Resource Consumption
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
PT-2026-108112
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description An infinite loop exists in the ff rtsp connect function within libavformat/rtsp.c when processing RTSP 3xx redirects. Because the software does not implement a redirect limit, a malicious RTSP server...
PT-2026-107989
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
EulerOS 2.0 SP15 : patch (EulerOS-SA-2026-3998)
According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...
Linux Distros Unpatched Vulnerability : CVE-2026-98258
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 convert...
CVE-2026-78669: Asymmetric Resource Consumption (Amplification)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
PT-2026-108314
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server. This occurs when the peer opens a large number of streams and subsequently...
PT-2026-108313
Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description Excessive CPU consumption occurs when parsing a Range header that contains a large number of small ranges. This issue affects the FileServerFS, ServeContent, and ServeFileFS functions...
CVE-2026-78667: Allocation of Resources Without Limits or Throttling
When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...
CVE-2026-78669: Asymmetric Resource Consumption (Amplification)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
GHSA-9M4W-FMJW-FVJQ Ghost: Regular Expression Denial of Service in External Media Inliner
Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...