CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-118772

The joi data validator for JavaScript is vulnerable to a quadratic work issue in the Joi.string().email({ multiple: true }) rule. Specifically, a separator regular expression's leading whitespace quantifier is retried at every position during long whitespace runs without a separator, causing sign...

Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to urllib3 vulnerabilities

Summary Platform Navigator in IBM Cloud Pak for Integration is vulnerable to urllib3 vulnerabilities CVE-2026-97687, CVE-2026-97688, CVE-2026-97689. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-97687 DESCRIPTION: urllib3 is an HTTP client library for Python. From...

CVE-2026-27654

CVE-2026-27654 NGINX ngxhttpdavmodule Heap Buffer Overflow via sizet Underflow Remote DoS / Potential RCE Description ngxhttpdavcopymovehandler in src/http/modules/ngxhttpdavmodule.c computes the destination URI length by subtracting the location prefix length from the Destination header's URI pa...

CVE-2026-33891

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service DoS vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse function inherited from the bundled jsbn library...

CVE-2026-39376

CVE-2026-39376 CVE-2026-39376Infinite redirect loop DoS via meta-refresh chain Summary When parse fetches a URL that returns an HTML page containing a tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An...

CVE-2026-111731

P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 whole module. The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use th...

CVE-2026-111731

The software P-Net (versions before 1.0.3 ) is vulnerable to a denial of service (DoS) due to an infinite loop triggered during the processing of a read request. Specifically, when handling a PDPortDataCheck record with subslot 0 (whole module), the loop over the ports fails to advance to the nex...

EUVD-2026-113005

P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 whole module. The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use th...

CVE-2022-0778

CVE-2022-0778 Contributors Jeong Junsoo @jeongjunsoo Summary The CVE-2022-0778 vulnerability affects the BNmodsqrt function in OpenSSL that computes the modular square root of a prime number. When this function processes a maliciously crafted certificate that is not based on a prime number, an...

CVE-2026-99135

A flaw was found in the Linux kernel's Device Mapper integrity dm-integrity subsystem. When processing storage discard requests under low-memory conditions with large integrity tag sizes, an error-handling path fails to properly advance the processing loop. A local user could exploit this conditi...

CVE-2026-119051

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

CVE-2026-119051

The flat library (versions through 6.0.1 ) contains an uncontrolled resource allocation vulnerability within the unflatten() function. The root cause is the processing of unbounded numeric keys, which allows an attacker to create massive sparse arrays. This can result in a Denial of Service (DoS)...

EUVD-2026-112817

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-99130

A flaw was found in the Linux kernel's iouring subsystem. A local attacker can exploit this vulnerability to cause a Denial of Service DoS by triggering an infinite loop during process exit. This issue occurs when an exiting task attempts to cancel requests on an iouring ring with pending work th...

CVE-2026-2763-POC

Vulnerability The vulnerability arises from the implementation of the for-in syntax. The scope of a for-in loop is represented by a pair of bytecodes: JSOP::Iter and JSOP::EndIter. CASEIter MOZASSERTREGS.stackDepth = 1; HandleValue val = REGS.stackHandleAt-1; JSObject iter = ValueToIteratorcx, va...

strilight

Strilight v0.2.0 High-Performance Algebraic Loop Lifting & Exact Rational Recurrence Engine for Python and C %20/%20O\log%20N-orange.svg Overview: Why Iterate When You Can Solve? Traditional compilers, runtimes, and JIT engines such as GCC, Clang, PyPy, or Numba treat loops as repetitive...