net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

DEBIAN-CVE-2026-87079

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...

CVE-2026-65634: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-65634

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-87081: Inefficient Algorithmic Complexity

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87079: Inefficient Algorithmic Complexity

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...

ALSA-2026:70191 Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 For more details about the security issues,...

RockyLinux 10 : yggdrasil-worker-package-manager (RLSA-2026:69099)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of...

AlmaLinux 10 : yggdrasil-worker-package-manager (ALSA-2026:69099)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of Servi...

Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 For more details about the security issues,...

org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents

A flaw was found in jsoup. A remote attacker could exploit an uncontrolled resource consumption vulnerability in the XmlTreeBuilder by providing a deeply nested XML document with uniquely-namespaced elements. This causes the builder to copy the entire inherited namespace map on every start elemen...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

SUSE-SU-2026:23867-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...