5060 matches found
CVE-2026-123273
Versions of ImageMagick before 7.1.2-35 and 6.9.13-60 are vulnerable to an infinite loop within the SVG decoder . The root cause is located in QueueAuthenticPixelCacheNexus in MagickCore/cache.c , which fails to validate the requested region's width and height. An attacker can provide a crafted S...
CVE-2026-121959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
CVE-2026-97701
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...
CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...
EUVD-2026-117032
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...
CVE-2026-121959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
CVE-2026-99244
A flaw was found in the Linux kernel's process ID PID namespace subsystem. This vulnerability allows a local user to cause a Denial of Service DoS through excessive CPU consumption. During namespace cleanup, repeated internal signal notifications can prevent the process reaper from entering a sle...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
EUVD-2026-116959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
CVE-2026-121959
FreeRDP versions prior to 3.32.2 are vulnerable to an infinite loop within the websocket_context_read function. The root cause is a failure to correctly handle a zero BIO result when a payload is still outstanding. An attacker controlling a malicious RD Gateway can trigger this by sending a trunc...
CVE-2026-121959 FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
CVE-2026-121959 FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
PT-2026-137011
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket context read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close notify, causing a client thread to spin and consume CPU unti...
CVE-2026-121959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
CVE-2026-121959: FreeRDP: FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO…
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
UBUNTU-CVE-2026-121959
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...
PT-2026-137106
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...
CVE-2026-121577
The whatstk library (versions 0.2.0 through 0.9.0) is vulnerable to Inefficient Regular Expression Complexity (CWE-1333) in the generate_regex() function located in whatstk/whatsapp/parser.py. The vulnerability arises because the function constructs a header regular expression by replacing %x cod...
SUSE-SU-2026:5064-1 Security update for python-PyJWT
This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...
CLEANSTART-2026-UR29764 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Security vulnerability affects the rabbitmq-cluster-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...