RockyLinux 10 : expat (RLSA-2026:74001)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74001 advisory. expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input...

cpython: Python HTMLParser quadratic complexity

A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

expat: Expat: Denial of Service via quadratic complexity in attribute processing

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service...

RLSA-2026:72663 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2025:1744623473)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744623473 advisory. - There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that...

CentOS Linux 7 [TuxCare] Security Update: python-idna (CENTOS7:CLSA-2025:1763568610)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1763568610 advisory. - A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc (CENTOS7:CLSA-2024:1727980155)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1727980155 advisory. - There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that...

SUSE SLED15 / SLES15 Security Update : jsoup, re2j (SUSE-SU-2026:4393-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4393-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1769084959)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769084959 advisory. - When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is...

RHEL 10 : expat (RHSA-2026:74001)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74001 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...

RockyLinux 9 : expat (RLSA-2026:72663)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72663 advisory. expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input...

MiracleLinux 9 : expat-2.5.0-6.el9_8.5 (AXSA:2026-1939:13)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1939:13 advisory. expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Inp...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

EUVD-2026-89003

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

expat: Expat: Denial of Service via quadratic complexity in attribute processing

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service...

Important: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

SUSE-SU-2026:4393-1 Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...