97 matches found
CVE-2026-74841
A flaw was found in Apache OFBiz. In multitenant environments, the application attempts to resolve tenant delegator names from user-supplied parameters before confirming that the specified tenant actually exists. Because internal resolution requests are retained in an internal cache even when...
CLEANSTART-2026-PC71052 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
CLEANSTART-2026-ZX47054 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-hive package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
SUSE CVE-2026-98857
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
AZL-109176 CVE-2026-98857 affecting package kernel for versions less than 6.6.161.1-1
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
CVE-2026-98857
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
EUVD-2026-103797
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
CVE-2026-98857
The Linux kernel contains a vulnerability where the ip_vs_lblcr_new() and ip_vs_lblc_new() functions create cache entries for every previously unseen destination address. Because the max_size parameter only triggers periodic reclamation after the limit is exceeded—and does not reclaim actively us...
Linux Distros Unpatched Vulnerability : CVE-2026-98857
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize onl...
CVE-2026-98857: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...
PT-2026-117076
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IP Virtual Server IPVS where the functions ip vs lblcr new and ip vs lblc new create cache entries for every previously unseen destination address. The max size...
PT-2026-128552
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip vs lblcr new and ip vs lblc new create cache entries for every previously unseen destination address. The table max size only tells the periodic collector to reclaim entries after the...
CLEANSTART-2026-SU09873 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
PT-2026-117856
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
CLEANSTART-2026-BK96216 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
jackson-databind -- denial of service
The Jackson project reports: CVE-2026-91776: TypeDeserializerBase caches the resolved deserializer under the raw, attacker supplied type id. With name based polymorphism and a fallback, every unrecognized type id adds an entry and the cache grows without bound. CVE-2026-91777: forward reference...
Astra Linux – Vulnerability in bind9
In BIND 9.3.0 - 9.11.35, 9.12.0 - 9.16.21, and versions 9.9.3-S1 - 9.11.35-S1 and 9.16.8-S1 - 9.16.21-S1 of the BIND Supported Preview Edition, as well as release version 9.17.0 - 9.17.18 of the BIND 9.17 development branch, exploiting broken authoritative servers using a flaw in response...
openssl: CMP indefinite cache growth of ExtraCerts
A flaw was found in OpenSSL. The CMP Certificate Management Protocol implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra...