UBUNTU-CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73643

js-yaml versions 5.0.0–5.2.2 expose a denial-of-service via exponential parsing time when loading untrusted YAML. In src/parser/parser.ts, readFlowCollection can double-parse nested flow sequences, causing O(2^n) work and potential CPU exhaustion for inputs under 200 bytes. Fixed in version 5.2.2...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

EUVD-2026-58184

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: CVE-2026-73569 Source advisory: MEND:CVE-2026-73569...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

CVE-2026-73569 affects fast-xml-parser (OrderedObjParser.js). When parsing a single XML with multiple DOCTYPE declarations (versions 5.9.3–5.10.1), addInputEntities() repeatedly resets entity-expansion limits, allowing repeated resets within one parse. This can cause excessive CPU use, event-loop...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-56657

Gitea SSH Key Parser Denial of Service...

EUVD-2026-58144

Gitea SSH Key Parser Denial of Service...

CVE-2026-56657

The Git repository management system Gitea contains a vulnerability in the parseKeyString() function within the models/asymkey/ssh_key_parse.go file. Due to access control deficiencies, a remote attacker could submit a specially crafted SSH key to trigger a denial of service , potentially leading...

CVE-2026-56657 Gitea SSH Key Parser Denial of Service

Gitea SSH Key Parser Denial of Service...

CVE-2026-56657 Gitea SSH Key Parser Denial of Service

Gitea SSH Key Parser Denial of Service...

CVE-2026-56657 Gitea SSH Key Parser Denial of Service

Gitea SSH Key Parser Denial of Service...

JLSEC-2026-1316

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8...

CVE-2026-73507

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-73556

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...