29202 matches found
urllib3: Chunked Deflate streaming can enter an infinite loop
Impacturllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once.urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...
PYSEC-2026-4176 urllib3: Chunked Deflate streaming can enter an infinite loop
Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
SummaryThere is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. DetailsThe problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...
PYSEC-2026-4148 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...
SUSE CVE-2026-97688
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...
SUSE CVE-2026-98087
In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...
NPM: devalue: Residual sparse-array CPU amplification in uneval
NPM: devalue: Residual sparse-array CPU amplification in uneval vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...
devalue: Residual sparse-array CPU amplification in uneval
uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...
Inefficient Algorithmic Complexity
Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...
GHSA-HX4R-W6WJ-J8FG devalue: Residual sparse-array CPU amplification in uneval
uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the uneval function when serializi...
Memory Allocation with Excessive Size Value
Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...
Allocation of Resources Without Limits or Throttling
Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the appearance stream rendering loop in appearancestream.py, where...
sqlparse: sqlparse: Denial of Service via inefficient SQL parsing
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input. This flaw causes inefficient processing of certain SQL patterns, leading to excessive CPU consumption and potentially a Denial of Service DoS...
sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit a vulnerability in the TokenList construction and string conversion processes, specifically when handling nested token subtrees. This flaw leads to quadratic CPU consumption, which can result in a Denia...
sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the groupcomments function to repeatedly rescan these statements, leading to...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
NPM: basic-ftp: Quadratic-time CPU denial of service in Client.list Unix directory-listing parser RELINE backtracking vulnerability discovered by ? in WordPress Npm basic-ftp versions = 6.2.0...
