PT-2026-123482

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save all enabled. PdfParser.next object id repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can...

CVE-2026-89314 Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds...

CVE-2026-89314

The jwkFields.CheckConsistency function is vulnerable to a quadratic-time complexity issue during the duplicate check of key_ops entries. Because the validation uses a pairwise nested loop, the processing cost grows with the square of the entry count. An attacker can provide a modestly sized (sub...

CVE-2026-89314 Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the TOML compiler in lib/compiler.js, where path strings were maintained using three string-keyed Sets. Every key segment re-joined its entire prefix on each assignment, and every array-of-tables...

GHSA-RXP7-6HXX-X8Q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

npm: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

npm: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process vulnerability discovered by ? in WordPress npm ip-address versions = 10.7.3...

GHSA-G4QV-2JXX-769H Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Summary A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. Details Exif.load in...

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Summary A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. Details Exif.load in...

Linux Distros Unpatched Vulnerability : CVE-2026-109348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in...

GHSA-GFR2-RV44-R23C markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Summary A link reference definition whose label or title is never closed is On² in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copyin...

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options regression since 14.0 vulnerability discovered by ? in WordPress npm markdown-it versions = 14.1.0, 14.3.3...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

EUVD-2026-105358

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758

The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...