CVE-2026-81880

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

CVE-2026-81880 radare2: Uncontrolled resource consumption in radare2 PEF loader

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

CVE-2026-81880

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

PT-2026-97003

Name of the Vulnerable Software and Affected Versions icalendar versions 6.1.0 through 7.2.1 Description The vInt.from ical function accepts an attacker-controlled VALARM REPEAT value. Applications requesting alarm times may eagerly expand this value without an application-level limit. This...

CVE-2026-81880: Uncontrolled Resource Consumption

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

CVE-2026-81885: Allocation of Resources Without Limits or Throttling

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

PT-2026-96781

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The NE relocation fixup-chain parser in radare2 lacks an active iteration limit or cycle detection. When opening a specially crafted NE executable where an in-bounds relocation entry points back to...

PT-2026-96776

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The Apple Preferred Executable Format PEF loader fails to properly bound relocSecCount values against the number of sections or complete relocation records in the input. This issue is triggered durin...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652

Temporal Server is vulnerable to excessive CPU consumption in its Schedule component. An authenticated caller with namespace write permission can create or update a Schedule that combines a fine-grained cadence with an exclusion calendar rejecting every candidate time, causing the server to evalu...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-16652: Unchecked Input for Loop Condition

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

SUSE CVE-2026-57224

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::fordirection, so a...

javadelight delight-nashorn-sandbox 0.5.5 Resource Consumption

javadelight delight-nashorn-sandbox version 0.5.5 contains an uncontrolled resource consumption vulnerability because dynamic JavaScript code evaluation can bypass statically inserted loop interruption checks and consume CPU...

CVE-2026-63452 Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With...

CVE-2026-63452 Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With...

CVE-2026-63452

Suricata (OISF), a network IDS/IPS/NSM engine, is affected in versions 8.0.0 through 8.0.6 . The HTTP/1 parser enforces a per-transaction decompression limit but does not cap the total number of small brotli compression bombs a single flow can submit. When the response-body-decompress-layer-limit...