Security update for avahi

This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

SUSE-SU-2026:3217-1 Security update for avahi

This update for avahi fixes the following issue: - CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451...

Security update for avahi

This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

SUSE-SU-2026:3216-1 Security update for avahi

This update for avahi fixes the following issue: - CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption bsc1268543...

CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-25427

Subscriber Broken Access Control in eRoom = 1.7.1 versions...

SUSE CVE-2024-50285

In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbdworkcache". It will cause OOM issue. ksmbd has a credit mechanism but it can'...

CVE-2026-21723 CVE-2026-21723 Record

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

PT-2026-63889

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

RockyLinux 9 : kernel (RLSA-2026:43307)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:43307 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final...

PT-2026-63873

Contributor SQL Injection in MapSVG = 8.14.0 versions...

PT-2026-63854

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request...

GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

GHSA-MVH2-CRG5-V77C Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

ALPINE-CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-32665

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...