CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61848

The Ruby CSS parser Crass (prior to version 1.0.7 ) is vulnerable to a denial of service (DoS) condition. When parsing input containing non-ASCII characters , inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time . An attacker can provide a malicious...

CVE-2026-61848 Crass: Non-ASCII characters cause superlinear CPU consumption

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

exploit-CVE-2016-6515

OpenSSH remote DOS Before 7.3 OpenSSH does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long string. This bug resides in auth-passwd.c in authpassword function. Attackers can exploit this issue to...

axios-redos

Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...

CVE-2022-30780_Checker

CVE-2022-30780 - lighttpd remote denial of service Description Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service CPU consumption from stuck connections because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on...

CVE-2026-116268

A flaw was found in perl-MIME-tools. A remote attacker can cause a Denial of Service DoS by supplying specially crafted Multipurpose Internet Mail Extensions MIME headers containing unclosed comments. Due to inefficient parsing of parameters lacking closing parentheses, the parser repeatedly scan...

CVE-2026-119196

A flaw was found in pyasn1. A remote attacker can cause a Denial of Service DoS by sending specially crafted Abstract Syntax Notation One ASN.1 data containing multiple constructed bit string fragments. When decoding these fragments, the library repeatedly copies and shifts accumulated bit data,...

CVE-2026-61848: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

pillow: pillow: Denial of Service via crafted multi-frame image conversion

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

pillow: pillow: Denial of Service via repeated EXIF headers

A flaw was found in Pillow. When processing a specially crafted image with repeated Exchangeable Image File Format EXIF metadata headers, the library repeatedly copies and parses the data. A remote attacker could exploit this vulnerability by providing a malicious image file to an application tha...

CVE-2026-119196

The pyasn1 Python library (prior to version 0.6.5 ) is vulnerable to a quadratic CPU consumption issue during constructed BIT STRING decoding . The BitStringPayloadDecoder repeatedly calls BitString.fromOctetString, shifting and copying an ever-growing SizedInteger for each fragment in BER , CER ...

CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

CVE-2026-61848

When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of...

DEBIAN-CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

EUVD-2026-112471

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs...

Crass: Non-ASCII characters cause superlinear CPU consumption

Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially...

GHSA-8VFG-2R28-HVHJ Crass: Non-ASCII characters cause superlinear CPU consumption

Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially...