47980 matches found
BIT-ETCD-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...
Security Bulletin: IBM Guardium Data Protection is affected by a Denial-of-Service (DoS) vulnerability in Micrometer (CVE-2026-40984)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions:...
tomcat: Apache Tomcat: Denial of Service via WebSocket chat example
A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...
org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak
A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...
CVE-2026-72179
A flaw was found in the Linux kernel's handling of cache information. This vulnerability occurs when the system fails to properly release memory references during certain operations. This oversight results in a memory leak, which can lead to resource exhaustion and potentially impact system...
CVE-2026-72269
A flaw was found in the Linux kernel's framebuffer device fbdev component, specifically within the uvesafb driver. This vulnerability occurs because memory allocated for display modes is not properly released during certain error handling paths. This oversight can lead to a memory leak, which mig...
CVE-2026-72290
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for s390 PCI. During the setup of guest interrupt forwarding, a reference count refcount to the Guest Interrupt Service Call GISC may not be properly released if subsequent setup steps fail. This resource leak can lead to...
Security Bulletin: Multiple Vulnerabilities in watsonx.data
Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 3 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-41695 DESCRIPTION: Spring Data Commons applications may be vulnerable to denial of service through resource...
mod_http2: Apache HTTP Server: HTTP/2 DoS by Memory Increase
A flaw was found in Apache HTTP Server. This late release of memory after effective lifetime vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS. The vulnerability can lead to resource exhaustion, making the server unavailable to legitimate users...
K000162959: Linux kernel vulnerability CVE-2026-64531
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving...
SUSE CVE-2026-70455
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...
SUSE CVE-2026-70462
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...
PT-2026-77148
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the...
PT-2026-77329
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A remote attacker who has compromised the renderer process can read memory outside the sandbox by using a crafted HTML page. This is caused by the use of an uninitialized resource in t...
Linux Distros Unpatched Vulnerability : CVE-2026-72038
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before...
Linux Distros Unpatched Vulnerability : CVE-2026-72167
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: pl353: fix probe resource allocation During probe, the devmioremap is called with the parent device instead of the current one. So when the module...
Linux Distros Unpatched Vulnerability : CVE-2026-72050
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following...
Linux Distros Unpatched Vulnerability : CVE-2026-72456
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If...
Linux Distros Unpatched Vulnerability : CVE-2026-72356
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: Fix missing credit release on failure in cifsissueread Fix missing release of credits in the failure path in cifsissueread lest retrying the subreq just...
