DEBIAN-CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

UBUNTU-CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

PT-2026-65495

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories. - Reachable Assertion CWE-617 in...

Apache Tomcat 11.0.0.M20 < 11.0.25

The version of Tomcat installed on the remote host is prior to 11.0.25. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat11.0.25security-11 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affect...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced CVE-2026-4410, CVE-2026-5516, CVE-2026-9071, CVE-2026-9320, CVE-2026-8646, CVE-2026-11541, CVE-2026-11806. An update to IBM CICS TX Advanced has been released to address these...

CVE-2026-5079

A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

openSUSE 16 Security Update : python-pyasn1 (openSUSE-SU-2026:21392-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21392-1 advisory. - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in...

The vulnerability of Dovecot and OX Dovecot Pro mail servers, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-13074

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to denial-of-service DoS when processing a JSON document CVE-2026-9563, improper synchronization using a shared resource CVE-2026-5516, providing weaker than expected security CVE-2025-14917, identity spoofing CVE-2026-3621,...

openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21372-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21372-1 advisory. This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF...

CVE-2026-63263

CVE-2026-63263 affects Elasticsearch’s ES|QL engine, where an authenticated user can submit a crafted query that triggers exponential CPU consumption during evaluation, causing uncontrolled resource exhaustion. The impact is denial of service as query worker resources become exhausted and ES|QL q...