CVE-2026-107677 FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-107677

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

EUVD-2026-95082

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-107677

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. CVE-2026-23451: bonding: prevent potential infinite loop in bondheaderparse...

SUSE-SU-2026:4595-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. - CVE-2026-23451: bonding: prevent potential infinite loop in bondheaderpars...

CVE-2026-107577 Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 inpu...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 inpu...

CLEANSTART-2026-AN71108 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CVE-2026-107696: Loop with Unreachable Exit Condition

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects...

EulerOS 2.0 SP15 : patch (EulerOS-SA-2026-3932)

According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...

Wireshark 1.8.x < 1.8.4 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.8.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.4 advisory. - Integer overflow in the dissectsackchunk function in epan/dissectors/packet-sctp.c in the SCTP dissecto...

PT-2026-108112

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description An infinite loop exists in the ff rtsp connect function within libavformat/rtsp.c when processing RTSP 3xx redirects. Because the software does not implement a redirect limit, a malicious RTSP server...

PT-2026-108038

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description A denial of service issue exists in the DASH demuxer. An attacker can cause an infinite loop and indefinite CPU consumption by providing an .mpd manifest with an empty SegmentTemplate media URL. This...

PT-2026-108111

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.3 Description An infinite loop issue exists in the HLS demuxer. The parse playlist function incorrectly accepts Master Playlist tags within Media Playlists. A remote attacker can exploit this by providing a crafted...

CVE-2026-107695: Loop with Unreachable Exit Condition

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

EUVD-2026-93559

ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop...

CVE-2026-106164

In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service...