CVE-2026-89862

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A local attacker could exploit this vulnerability by triggering an error in the qla28xxvalidateflashimage function. Due to incorrect error handling, Block SCSI Generic BSG jobs are not properly completed, causing them to remain active an...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via getcontentdecoder in src/zapros/models.py, where an attacker can send an HTTP response with an unbounded number of...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression of streaming responses in decoders.py, where compressed content gzip, deflate, or brotli is decompressed...

EUVD-2026-85288

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated...

DEBIAN-CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

DEBIAN-CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

UBUNTU-CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

UBUNTU-CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

UBUNTU-CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-79677

A concurrency bug in Apache Tomcat allows an attacker to trigger a denial of service (DoS) by causing lost timeouts during asynchronous WebSocket writes . This vulnerability affects the following versions: 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-78383

Apache Tomcat is vulnerable to a denial of service (DoS) attack due to a resource allocation flaw where requests without a body can pin an AJP processing thread . This issue impacts versions 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Older End-of-Life v...

php: PHP: Denial of Service via reserved device names on Windows

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...