CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-65628

josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...

CVE-2026-108331 Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.

Tanium addressed an infinite loop vulnerability in Threat Response Client Extension...

CVE-2026-108331

Tanium addressed an infinite loop vulnerability within the Threat Response Client Extension . This flaw, associated with CWE-674 (Uncontrolled Recursion) and CWE-400 (Uncontrolled Resource Consumption), could impact the availability of the service. The CVSS 3.1 score is 3.3 (Low), reflecting a lo...

EUVD-2026-111241

Tanium addressed an infinite loop vulnerability in Threat Response Client Extension...

AZL-111172 CVE-2026-109088 affecting package libXtst 1.2.4-1

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

DEBIAN-CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

ALPINE-CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109088 libXtst RECORD EnableContext Reply Endless Loop

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109088 libXtst RECORD EnableContext Reply Endless Loop

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

EUVD-2026-111114

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109088

The libXtst library is vulnerable to an endless loop when processing malformed RECORD EnableContext replies from a malicious X server. This occurs specifically in the parse_reply_call_callback function in versions prior to 1.2.6 . The root cause involves a lack of proper validation of reply eleme...

CVE-2026-117540 svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540 svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540

The svg-sanitizer library (versions 0.5.3 before 1.1.0 ) is vulnerable to a Denial of Service (DoS) attack within the Sanitizer::sanitize() function. The root cause is an inefficient algorithmic complexity issue where the software repeatedly rescans the entire input while stripping PHP tags. An u...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in source-map-js (CVE-2026-93749)

Summary IBM Db2 Developer Extension is affected by vulnerability in source-map-js CVE-2026-93749 Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION: source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary...

CVE-2026-116671

A flaw was found in Xpdf. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted JPEG 2000 image. Due to improper validation of the progression order field, processing the file triggers an infinite loop that causes the application to hang...

CLEANSTART-2026-BP13814 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...