mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

PT-2026-102362

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function is affected by a regular expression issue where lazy PEM processing causes extensive backtracking. This happens when input resembling a certificate contains repeated BEGIN...

CVE-2026-102270: Inefficient Regular Expression Complexity

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via excessive allocation. An attacker can exhaust system resources by sending...

CVE-2026-100648 vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

vllm before 0.29.0 fails to enforce VLLMMAXAUDIOCLIPFILESIZEMB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decodin...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...

Excessive Iteration

Overview Affected versions of this package are vulnerable to Excessive Iteration in the PullImage process. An attacker can cause excessive CPU and memory consumption by supplying a crafted OCI image index with deeply nested or heavily fanned-out descriptor graphs, leading to prolonged stalls and...

Excessive Iteration

Overview Affected versions of this package are vulnerable to Excessive Iteration in the PullImage process. An attacker can cause excessive CPU and memory consumption by supplying a crafted OCI image index with deeply nested or heavily fanned-out descriptor graphs, leading to prolonged stalls and...

GHSA-PG57-6JWG-Q645 Containerd has image-pull DoS via crafted OCI index graph amplification

Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the PullImage operation, the recursive traversal and processing of child...

AZL-105314 CVE-2026-67413 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic exchange accepted a client-controlled rjmserlangselector binding expression whose LIKE evaluator expanded percent and underscore wildcards in...

CVE-2026-67413 RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic exchange accepted a client-controlled rjmserlangselector binding expression whose LIKE evaluator expanded percent and underscore wildcards in...

UBUNTU-CVE-2026-98157

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

OESA-2026-4060 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. From 3.0...

PT-2026-98924

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.3.5 Description An authenticated user with permissions to bind a queue to a topic exchange and publish to it can cause a denial of service. By using consecutive segments in a binding key, the user can force topic...

Linux Distros Unpatched Vulnerability : CVE-2026-6669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a maliciou...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-77421

A flaw was found in the JLine built-in nano editor's regular expression regex search mode. A remote attacker could exploit this by providing a specially crafted search term. This could lead to excessive central processing unit CPU consumption, causing the editor session to become unresponsive and...

Regular Expression Denial Of Service (ReDoS)

JLine is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to processing user-controlled search terms with Java's backtracking regular expression engine without execution or backtracking limits, which allows an attacker to trigger excessive CPU consumption and...

Regular Expression Denial Of Service (ReDoS)

JLine is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to incomplete escaping of regex metacharacters in the HISTORYIGNORE configuration, which allows an attacker to supply a malicious nested-quantifier expression that causes excessive CPU consumption and...

PT-2026-98317

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.7.36 containerd versions prior to 2.0.13 containerd versions prior to 2.2.9 containerd versions prior to 2.3.6 containerd versions prior to 2.4.1 Description A crafted OCI index graph can cause excessive CPU and...