15899 matches found
PYSEC-2026-3612 pypdf: Possible infinite loop for not terminated inline images
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...
PYSEC-2026-3613 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. Patches This...
SUSE-SU-2026:23162-1 Security update for helm
This update for helm fixes the following issues: Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...
SUSE-SU-2026:23052-1 Security update for helm
This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...
Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0
Summary Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. Vulnerability Details...
Denial Of Service (DoS)
nanoid is vulnerable to Denial Of Service. The vulnerability is due to an infinite loop in customAlphabet and customRandom when configured with a size of 0, allowing attacker-controlled input to hang the calling thread and cause application unavailability...
thrift: Apache Thrift: Denial of Service via infinite loop
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...
SUSE-SU-2026:23051-1 Security update for google-guest-agent
This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...
net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...
K000162734: Apache HTTP Server vulnerability CVE-2026-44186
Security Advisory Description Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the modproxyftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version...
net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814
Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814. This bulletin contains information regarding the vulnerability and its remediation Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2...
SUSE-SU-2026:23077-1 Security update for google-guest-agent
This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...
Fedora 44 : goaccess (2026-b1c2d1af74)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b1c2d1af74 advisory. Update to goaccess 1.11. Notable fixes: - Fixed a heap buffer overflow when parsing malformed Opera user agents - Fixed an infinite loop while writing log...
Fedora 43 : goaccess (2026-a488a993d1)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a488a993d1 advisory. Update to goaccess 1.11. Notable fixes: - Fixed a heap buffer overflow when parsing malformed Opera user agents - Fixed an infinite loop while writing log...
DoS (Denial of Service) io.netty:netty-codec Dependency in Crowd Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...
SUSE CVE-2026-64611
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...
Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang net library (CVE-22026-33814)
Summary Golang net library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang net is affected by vulnerability that may allow prototype pollution, allowing attackers to manipulate object prototype attributes through vulnerable merge and object conversion APIs...
zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit
Summary NonFinalizedState::handlereorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previousblockhash points...
GHSA-3WHF-VGF2-9W6G zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit
Summary NonFinalizedState::handlereorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previousblockhash points...