EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-3742)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in Apache HTTP Server up to 2.4.67 Web Server and classified as critical.Using CWE to declare the problem leads to CWE-12...

Linux Distros Unpatched Vulnerability : CVE-2026-90391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or...

CVE-2026-61633: Loop with Unreachable Exit Condition

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

EulerOS Virtualization 2.11.1 : python3 (EulerOS-SA-2026-3456)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods...

Linux Distros Unpatched Vulnerability : CVE-2026-90053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bound...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

CVE-2026-93690: Loop with Unreachable Exit Condition

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

EUVD-2026-80779

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the ChunkedDecoder::handleData process. An attacker can cause the process to enter an infinite loop and exhaust CPU resources by sending a malformed HTTP message with Transfer-Encoding: chunked that exploits specific...

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

GHSA-X424-64QH-5J54 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

GHSA-GQ9C-WMRM-5HVR HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

EUVD-2026-80998

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the inflate process in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java. An attacker can pin a JVM worker thread indefinitely by supplying a malformed Smart Health Card JWT with zip:"DEF" and a...

Security Bulletin: nanoid-3.3.18.tgz (Publicly disclosed vulnerability found by Scanner)

Summary nanoid before 5.1.6/5.1.16 has infinite loops in customAlphabet/customRandom/nanoid non-secure when passed a size of 0 or negative value, hanging the calling thread and causing DoS. CVSS: 5.9 Medium, CWE-835. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before...

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. The height is take...

CVE-2026-52852 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

CVE-2026-52852 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

CVE-2026-52852

Traccar , an open-source GPS tracking system, is vulnerable to an uncontrolled infinite loop DoS prior to version 6.14.0 . An authenticated user with group-management and report permissions can create a cyclic group-parent hierarchy . The resource class GroupResource permits the cycle, while Attr...