npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service vulnerability discovered by ? in WordPress npm stream-json versions = 2.0.0, = 3.6.0...

GHSA-FC9G-5QG7-MF45 Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

CVE-2026-114129

The stream-json micro-library (versions 2.0.0 through 3.7.0 ) is vulnerable to a CPU denial of service due to inefficient algorithmic complexity in the FlexAssembler component. When processing string or regular-expression path filters, the library joins the full key stack on every container start...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

RHEL 10 : dogtag-pki (RHSA-2026:77648)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77648 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following...

RHEL 10 : dogtag-pki (RHSA-2026:86621)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86621 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the...

RHEL 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:80504)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80504 advisory. This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another...

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Summary Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The RarVM.ExecuteCode loop is intended to be bounded by maxOpCount, but jump instructions can bypass this limit when setIP is called with a target instruction pointer...

MiracleLinux 9 : jackson-annotations-2.21-1.el9_8, jackson-core-2.21.6-1.el9_8 (AXSA:2026-2057:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2057:01 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-core / pki-jackson-databind / etc (crlsa-2026_80504)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680504 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

RLSA-2026:80504 Important: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU...

jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update is available for jackson-databind, jackson-modules-base, jackson-core, jackson-jaxrs-providers. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This is...

CVE-2026-109348

The Gitoxide gix-mailmap component (versions before 0.35.0 ) is vulnerable to a CPU Denial of Service via quadratic-time parsing in Snapshot::from_bytes . An attacker can commit a crafted .mailmap file with descending-ordered entries, triggering repeated front inserts that exhaust CPU resources. ...

CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2026:80504 Important: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU...

Important: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU...

RLSA-2026:77648 Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token Processing...