750 matches found
UBUNTU-CVE-2026-103261
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
CVE-2026-103261
The Tornado web framework versions prior to 6.5.9 are vulnerable to a Denial of Service (DoS) condition. The root cause is a lack of limits on the number of query string fields processed within the HTTPServerRequest.__init__ component. A remote, unauthenticated attacker can exploit this by sendin...
EUVD-2026-90655
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
Regular Expression Denial Of Service
Axios is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to excessive regular-expression backtracking in DATAURLPATTERN when fromDataURI processes malformed data: URLs with many slash characters and no comma, allowing an attacker to block the Node.js event loop...
PT-2026-105502
Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RE LINE regex has two adjacent S+?:sS+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after it...
PT-2026-105866
Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...
CVE-2026-103261: Allocation of Resources Without Limits or Throttling
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Summary HTTPServerRequest.init in tornado/httputil.py parses the URL query string via parseqsbytes with no field-count limit — while the sibling POST-body parsing path parsebodyarguments received a maxnumfields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed, explicitly ...
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive...
SUSE CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...
SUSE CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...
PT-2026-103794
Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query...
Linux Distros Unpatched Vulnerability : CVE-2026-102414
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...
Linux Distros Unpatched Vulnerability : CVE-2026-102277
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function...
GHSA-Q2HR-2G5M-VWHR brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...
CVE-2026-103043
The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...
NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds vulnerability discovered by ? in WordPress Npm markdown-it versions 14.3.1...
GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...