CVE-2026-128131

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

CVE-2026-128068

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

EUVD-2026-125592

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128068 rails-html-sanitizer: Possible regular expression denial of service with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128068

The rails-html-sanitizer library (versions 1.0.3 through 1.7.1) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause lies in the Rails::HTML::PermitScrubber component, where a pattern used to check SVG href and xlink:href local references causes all-whitespace values t...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

CVE-2026-128237

Scapy before 2.8.0 contains a denial of service vulnerability in BERnumdec and BERcodecOID.dodec that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught...

CVE-2026-126300

The NLTK library, versions 3.2.5 to before 3.10.4 , is vulnerable to an algorithmic complexity vulnerability in the TreebankWordTokenizer.span_tokenize function. The root cause is repeated list.pop(0) calls, which allow a remote attacker to trigger quadratic CPU consumption . By submitting long s...

CVE-2026-128237

The software Scapy versions prior to 2.8.0 is vulnerable to a Denial of Service (DoS) condition. The flaw exists in the BER_num_dec() and BERcodec_OID.do_dec() functions, where remote attackers can exhaust CPU resources by providing oversized OID arcs containing numerous base-128 continuation byt...

CVE-2026-126205

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

CVE-2026-126205

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

EUVD-2026-124678

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

PT-2026-146052

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG ALLOW LOCAL HREF with a regular expression whose line anchor and newline-matching...

CVE-2026-126205: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

CVE-2026-119233

proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A...

OESA-2026-4789 python-pyasn1 security update

Abstract Syntax Notation One ASN.1 is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fixes: pyasn1 is a...

OESA-2026-4788 python-pyasn1 security update

Abstract Syntax Notation One ASN.1 is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fixes: pyasn1 is a...

OESA-2026-4787 python-pyasn1 security update

Abstract Syntax Notation One ASN.1 is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fixes: pyasn1 is a...

OESA-2026-4786 python-pyasn1 security update

Abstract Syntax Notation One ASN.1 is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fixes: pyasn1 is a...

Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing...