CVE-2026-86344

A flaw in 389-ds-base allows an unauthenticated remote attacker to perform a denial of service (DoS) attack. By sending a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on a single connection, the attacker can force the server to hand that connection to a second ...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-86344 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

CVE-2026-96780

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text and textSync can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions,...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104020

The Amazon Ion Python library (versions prior to 0.15.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the Ion reader . A remote, unauthenticated actor can crash the application by providing a crafted, deeply nested Ion value. To remediate this issue, users should upgrade...

qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization

A flaw was found in qtbase. Uncontrolled recursion in Qt's QDomDocument serialization QtXml allows a remote attacker to provide deeply nested untrusted XML, leading to stack exhaustion. This can cause the application to crash, resulting in a Denial of Service DoS...

GO-2026-6512 Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass in github.com/caddyserver/caddy...

GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

GO-2026-6581 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin - remote node memory/goroutine exhaustion DoS in github.com/klever-io/klever-go...

GO-2026-6550 SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo

SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo...

GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...

GO-2026-6559 SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...

GO-2026-6597 Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd...

GO-2026-6569 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge...

CVE-2026-96780 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text and textSync can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions,...

CVE-2026-96780

The figlet.js library (a JavaScript FIG driver) is vulnerable to a Denial of Service via an unbounded loop in its text() and textSync() functions. The root cause is that when the whitespaceBreak option is enabled and the width is set smaller than a single FIGlet character, the breakWord() functio...

CVE-2026-82357

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...