Astra Linux – Vulnerability in cairosvg

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG, there was exponential denial of service due to recursive elements being amplified in the cairosvg/defs.py file. This caused CPU exhaustion with even small inputs...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: l2tp: Avoid possible recursive deadlock in l2tptunnelregister When a file descriptor of the pppol2tp socket is passed as a file descriptor of the UDP socket, a recursive deadlock occurs in l2tptunnelregister. This situation can b...

Astra Linux – Vulnerability in qt4-x11, qtbase-opensource-src

A issue was discovered in Qt before version 5.15.15, in versions 6.x before 6.2.10, and in versions 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

Astra Linux – Vulnerability in rsync

There is a path traversal vulnerability in rsync. This vulnerability stems from a behavior enabled by the --inc-recursive option, which is a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive...

Astra Linux – Vulnerability in bind9

If a BIND resolver performs DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU resources. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries see:...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A denial-of-service issue was detected, possibly due to a recursive locking scenario, which led to a deadlock in the tableclear function in drivers/md/dm-ioctl.c within the Linux Kernel Device Mapper-Multipathing sub-component...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: dm-verity: Recursive forward error correction has been disabled. There are two issues with this recursive correction mechanism: 1. It may cause a denial-of-service attack. In the fecreadbufs function, there is a loop with 253...

PT-2026-91192

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: bind (UTSA-2023-003035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003035 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the...

UBUNTU-CVE-2026-90472

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CVE-2026-90472

msgpack-java through version 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue(), which recursively deserializes arrays and maps without enforcing nesting depth limits. An unauthenticated, network-based attacker can craft a payload with deeply nested arrays to exhaust ...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

CVE-2026-89065

projen before 0.101.37 is affected by a relative path traversal in its generated file manifest cleanup component . Crafted entries in the version-controlled file manifest, consumed during project synthesis, can cause recursive deletion of files and directories outside the project directory that a...

EUVD-2026-76150

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...