PT-2026-90206

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 file system where the directory cookie position is incorrectly rebuilt in the ocfs2 dir foreach blk el function on 32-bit kernels. This occurs because the ma...

CVE-2026-89634: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89744: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...

CVE-2026-89744: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...

PT-2026-96483

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode for each child node When iterate over children of a fwnode that has a secondary fwnode, fwnode get next child node can enter an infinite loop if the secondary fwnode has more than one...

Fedora 45 : perl-XML-Bare (2026-3a2db4368a)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a2db4368a advisory. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes...

PT-2026-90087

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A flaw exists in the dm-pcache component where the cache replay function follows the on-media last-kset chain using the next cache seg id variable without implementing cond resched. A forged...

PT-2026-90294

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the do region function when handling DM IO BIO requests. The system previously built destination bios by iterating through the source bio's biovec and adding pages...

PT-2026-96381

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2 dir foreach blk el, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-s blocksize - 1 | offset; ctx-pos is loff t signed 64-bit, while sb-s...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

GHSA-8R35-5X5R-HV74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

EUVD-2026-75172

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...

Infinite loop

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Infinite loop through the POST /api/v1/folders/id/update/parent handler, which allows a folder to be moved under itself or one of its subfolders, creating a cycle in the folder hierarchy. An attacker can caus...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to negative length validation in readbyte, int, int in src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java. An attacker can spin a caller thread indefinitely by supplying a negative len to read, which...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

DEBIAN-CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-89045 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-89045 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 contain a denial-of-service vulnerability in ZstdInputStreamNoFinalizer.read(). The method fails to validate negative length parameters, causing an infinite loop while holding the stream monitor and blocking all other threads from accessing the stream. T...