PT-2026-108994

USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

PT-2026-102667

Name of the Vulnerable Software and Affected Versions urllib3 versions 2.6.2 through 2.7.x Description An issue exists where HTTPResponse.stream and HTTPResponse.read chunked can enter an infinite loop. This occurs when a server sends a chunked Deflate response Transfer-Encoding: chunked and...

CVE-2026-97688: Loop with Unreachable Exit Condition

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

Wireshark : CVE-2026-96418 : TIFF protocol dissector infinite loop

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-97546

A flaw was found in the Linux kernel's XFS file system. A local user could trigger this vulnerability by mounting or repairing a corrupted file system containing zero-length directory entries. When salvaging these malformed entries during directory repair operations, the kernel fails to advance a...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...

GHSA-F67J-2JQW-JPQ7 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

A Denial of Service DoS vulnerability exists in @angular/platform-server's DOM emulation parser domino. When processing untrusted user input containing an incomplete DOCTYPE declaration ending with whitespace before EOF such as , and keyword matching advance nextchar, the EOF branch case -1: // E...

CVE-2026-98159

A flaw was found in the Linux kernel's MediaTek MT7921 Wi-Fi driver. The driver fails to validate the region count and record lengths when parsing Country Location Control CLC firmware data. An attacker capable of supplying a malformed firmware image could trigger an out-of-bounds memory access o...

CVE-2026-93828

A flaw was found in the Linux kernel's exFAT file system. A local user capable of mounting a corrupted or maliciously crafted storage volume can trigger an integer calculation error when the system processes an uppercase translation table with a size of zero. This failure causes the kernel to ent...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Immutable.js

Summary IBM DataPower Gateway affected by multiple CVEs in Immutable.js Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the functional set, setIn,...

Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

CVE-2026-98123

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker can cause a Denial of Service DoS by sending a specially crafted network packet during an active SCTP connection. A discrepancy in how parameter padding is processed causes the syste...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

K000163428: PHP vulnerability CVE-2026-7263

Security Advisory Description In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, DOMNode::C14N method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in nanoid (CVE-2026-67213, CVE-2026-67214)

Summary Multiple vulnerabilities in the nanoid generator library CVE-2026-67213, CVE-2026-67214 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before 5.1.6 contain...

Security Bulletin: Impacted IBM Optim for z/OS 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/Pgx, cloudflare/cfSSL, x/net

Summary IBM Optim for z/OS version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages jackc/Pgx, cloudflare/cfSSL and x/net which are affected by medium, high and critical severity vulnerabilities. IBM Optim for z/OS 2.0.0 resolves these vulnerabilities by upgrading the affected open-source...