5293 matches found
PT-2026-90822
Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description A race condition exists within an unknown function of the Save Account Job component. This issue allows a remote attacker to initiate an attack, althou...
CVE-2026-90776: Inefficient Algorithmic Complexity
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...
CVE-2026-90506: Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-68497
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to...
Linux Distros Unpatched Vulnerability : CVE-2024-58382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...
CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...
CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...
RLSA-2026:66364 Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
PT-2026-90847
Name of the Vulnerable Software and Affected Versions Nodemailer versions 9.1.0 through 10.0.4 Description The addressparser component contains an algorithmic complexity issue when parsing email addresses that include RFC 5322 comments. A remote attacker can craft malicious email headers using...
AlmaLinux 9 : git-lfs (ALSA-2026:66364)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:66364 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
SummaryHTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
SummaryWhen SQL is formatted with reindentation enabled, ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-tok...
PYSEC-2026-3923 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Summary When SQL is formatted with reindentation enabled, ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the...
icalendar has Algorithmic Complexity in Equality
SummaryComponent.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==,...
PYSEC-2026-3851 icalendar has Algorithmic Complexity in Equality
Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...
PYSEC-2026-3832 eml_parser vulnerable to DoS via deeply nested parens in Received headers
Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...