CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

EUVD-2026-85229

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Apache Tomcat is vulnerable to a Denial of Service (DoS) attack due to an uncontrolled resource consumption issue occurring during the sending of a WebSocket close message . The root cause is a busy wait condition that can be triggered by an attacker. This vulnerability affects versions 11.0.0-M5...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-91018

A flaw was found in lwIP Lightweight IP, a widely used open-source TCP/IP stack. This double free vulnerability allows an adjacent network attacker to potentially execute arbitrary code, corrupt memory, or cause a denial of service DoS on the affected system. The most severe impact is the...

CVE-2026-81885

A flaw was found in radare2, a reverse engineering framework. By opening a specially crafted NE executable file, an attacker could trigger an an infinite loop within the application's relocation parser. This continuous processing would consume excessive CPU and memory, leading to a denial of...

pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count

A flaw was found in PgBouncer. A malicious or compromised PostgreSQL backend can exploit a missing upper bound on the key derivation iteration count during SCRAM Salted Challenge Response Authentication Mechanism authentication. This can lead to uncontrolled CPU consumption in PgBouncer,...

CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-84384

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a crafted HEIF or AVIF file containing malicious metadata or image data. This could cause the application to consume an unbounded amount of memory during...

EUVD-2026-85174

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001

The Apache Sling XSS component is vulnerable to an XML entity expansion attack due to improper restriction of recursive entity references in DTDs. This issue affects versions before 2.4.12 . To remediate the vulnerability, users are recommended to upgrade to version 2.4.12 . No specific exploit i...

CVE-2026-57225

A flaw was found in Suricata, a network Intrusion Detection System. A NULL pointer dereference vulnerability exists when loading JSON or NDJSON datasets. This occurs because the system incorrectly assumes a configured valuekey will always resolve to a string. A trusted or untrusted dataset or rul...

CVE-2026-63635

A flaw was found in OpenImageIO. A remote attacker could exploit this by crafting a malicious PSD Photoshop Document file with an invalid color mode. When processed by OpenImageIO with raw color or raw data enabled, this crafted file bypasses validation, leading to an out-of-bounds read and...

CVE-2026-61723

A flaw was found in FluidSynth. The native DLS parser, when processing ptbl chunks, does not properly validate the size calculation, leading to an integer overflow. A remote attacker could craft a malicious DLS file that, when processed, causes the application to attempt to allocate an excessive...

CVE-2026-61722

A flaw was found in FluidSynth, a software synthesizer. This vulnerability, an integer overflow, exists in the native DLS Downloadable Sounds parser when it validates articulation chunks. A remote attacker could exploit this by providing a specially crafted DLS file, which causes the parser to...

CVE-2026-57224

A flaw was found in Suricata. The DHCP and RDP parsers fail to record packet direction for stateless transactions. This allows a network sensor observing only one direction of traffic to accumulate an unbounded list of per-flow transactions. Consequently, this leads to increasing CPU and memory...

CVE-2026-71418

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...

CVE-2026-67549

A flaw was found in OpenImageIO. A remote attacker could exploit this vulnerability by tricking a user into processing a specially crafted 1-bit CMYK TIFF image. The tiffinput::bitconvert function incorrectly writes 8-bit output into a smaller buffer allocated for 1-bit data, causing a heap...

CVE-2026-63446

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. Due to an inverted guard in the AppLayerParserSetTransactionInspectId function, transactions on flows passed by a pass rule or exception policy are not...