CVE-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

Security update for podofo

This update for podofo fixes the following issues: CVE-2018-8002: infinite loop vulnerability in ParseFileComplete bsc1084891. CVE-2020-18971: stack-based buffer overflow in src/base/PdfDictionary.cpp bsc1190178. CVE-2021-30470: uncontrolled recursive call of funtions in src/base/PdfTokenizer.cpp...

SUSE-SU-2026:4311-1 Security update for podofo

This update for podofo fixes the following issues: - CVE-2018-8002: infinite loop vulnerability in ParseFileComplete bsc1084891. - CVE-2020-18971: stack-based buffer overflow in src/base/PdfDictionary.cpp bsc1190178. - CVE-2021-30470: uncontrolled recursive call of funtions in...

OPENSUSE-SU-2026:21953-1 Security update for python-asyncssh

This update for python-asyncssh fixes the following issues: Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972...

CVE-2026-81885

A flaw was found in radare2, a reverse engineering framework. By opening a specially crafted NE executable file, an attacker could trigger an an infinite loop within the application's relocation parser. This continuous processing would consume excessive CPU and memory, leading to a denial of...

pgbouncer: PgBouncer: Denial of Service via integer overflow in packet buffer growth

A flaw was found in PgBouncer. An unauthenticated remote attacker can exploit an integer overflow in the packet buffer growth logic by providing sufficiently large input. This causes the buffer size computation to overflow, leading to an infinite loop. As a result, a CPU core is saturated, and al...

Wireshark 4.4.x < 4.4.17 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.17. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.17 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 -...

CVE-2026-93690

A flaw was found in uri-js. A remote attacker can exploit a vulnerability in the removeDotSegments function by providing a specially crafted path segment that begins with Unicode line or paragraph separators. This can cause an infinite loop, leading to the Node.js event loop blocking indefinitely...

SUSE CVE-2026-90420

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfscleansegments syzbot reported a hung task in nilfstransactionbegin. This occurs because the cleaner ioctl falls into an infinite loop if nilfssegctorconstruct repeatedly returns -EROFS e.g. the...

SUSE CVE-2026-93065

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

SUSE-SU-2026:4284-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-53109: net: tunnels: annotate lockless accesses to dev-neededheadroom bsc1242405 bsc1275784. - CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-53109: net: tunnels: annotate lockless accesses to dev-neededheadroom bsc1242405 bsc1275784. CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944...

PT-2026-96673

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An issue exists where the encode punycode function fails to validate if the input is well-formed UTF-8. When a string with the UTF-8 flag set over malformed bytes reaches the encoder, the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090113)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090113 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks...

ROS-20260922-73-0045

The vulnerability of the rt6fillnode function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploitation of this vulnerability could allow a remote...

SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:4270-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4270-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:4272-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4272-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header. -...

urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding

A flaw was found in urllib3. A malicious server can trigger a Denial of Service DoS by returning a specially crafted compressed response containing trailing bytes. When streaming the response in chunks, the decompression logic can enter an infinite loop by repeatedly processing unconsumed data...