net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a DoS...

SUSE-SU-2026:4365-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. - CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Apache Thrift

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway versions 11.0.0.3 and 10.6.0.11 Vulnerability Details CVEID:CVE-2026-55968 DESCRIPTION: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Immutable.js

Summary IBM DataPower Gateway affected by multiple CVEs in Immutable.js Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the functional set, setIn,...

Important: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

expat: Expat: Denial of Service via quadratic complexity in attribute processing

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

ALSA-2026:72448 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

CVE-2026-102270: Inefficient Regular Expression Complexity

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

Important: rsync

Issue Overview: rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to...

EUVD-2026-87956

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

CVE-2026-101041

The vulnerability-lookup web application contains a TOCTOU race condition in its account recovery functionality (/user/confirm_account/). Specifically, the logic in the User model (website/models/user.py) and view layer (website/web/views/user.py) verifies and consumes single-use recovery tokens ...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the address parser in src/addressparser/index.ts, where the regex /\s\b^@\s+@^\s+\b\s/ was used to search free text for a...

Exploit for Inefficient Regular Expression Complexity in Kjd Internationalized_Domain_Names_In_Applications

Domain Validation Service — CVE-2024-3651 Demo A Python Flask...

BIT-GITLAB-2026-1168 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

BIT-GITLAB-2025-14871 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

PT-2026-98974

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

PT-2026-98975

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...