CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

The msgpack5 library (a msgpack v5 implementation for Node.js and the browser) is vulnerable to a quadratic CPU use issue in versions prior to 6.1.0 . The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk arrives. A remote peer can exploit this by spli...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

EUVD-2026-95108

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...

Security Bulletin: Vulnerability in Apache Log4j Core shipped in Tivoli Netcool/OMNIbus (CVE-2026-49844)

Summary The Netcool/Omnibus 'Administrator GUI' and 'Accelerated Event Notification GUI' desktop components use a version of Apache Log4j that contains a known vulnerability. This has been addressed. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

SUSE CVE-2026-98292

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

GHSA-FPF4-VWCP-V4HP Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

Regular Expression Denial of Service (ReDoS)

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the webfetch tool in pydanticai/commontools/webfetch.py, where response body decoding is performed synchronously on the event loop usi...

CVE-2026-107290

The Pydantic AI Python agent framework is vulnerable to a denial-of-service condition in the local web_fetch_tool and the WebFetch local fallback process. Specifically, versions 1.77.0 to 1.107.6 and 2.44.0 exhibit quadratic title extraction , whitespace normalization, and ordered-list numbering ...

CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107290

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

EUVD-2026-95093

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

Azure Event Grid Spoofing Vulnerability

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

CVE-2026-105891

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-105893

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...