CVE-2026-77680

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

GHSA-CV84-9P8J-FJ68 icalendar has Algorithmic Complexity in Equality

Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...

icalendar has Algorithmic Complexity in Equality

Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...

CVE-2026-55099 icalendar: Algorithmic Complexity in Equality

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

EUVD-2026-65743

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

CVE-2026-55099 icalendar: Algorithmic Complexity in Equality

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

CVE-2026-55099

icalendar is an RFC 5545 iCalendar parser and generator for Python. In versions 7.1.0 through 7.1.3 , the Component equality method in src/icalendar/cal/component.py compares nested subcomponents using two membership loops that recursively invoke the same method on child components, producing O(2...

CVE-2026-55099 icalendar: Algorithmic Complexity in Equality

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child...

Security Bulletin: Vulnerability in js-yaml affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in js-yaml has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

CVE-2026-77680: Inefficient Algorithmic Complexity

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

PT-2026-81851

Name of the Vulnerable Software and Affected Versions libsoup versions containing the CVE-2025-32907 fix but not merge request !550 Description An algorithmic complexity flaw exists in the processing of HTTP Range headers. The issue occurs within the soup message headers get ranges internal...

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of ON² for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker...

The vulnerability of the storeAtts() function in the Expat library allows a hacker to trigger a service failure.

The vulnerability of the storeAtts function in the Expat library is related to its algorithmic complexity. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-70453

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS. Mitigation Disable...

BIT-KIBANA-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service

Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...

BIT-ELK-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service

Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...

BIT-ELASTICSEARCH-2026-72685 Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

PT-2026-79887

Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...

CVE-2026-76401: Inefficient Algorithmic Complexity

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event...

PT-2026-79946

Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...