libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

Neethi: Neethi: Denial of Service via crafted WS-Policy documents

A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service DoS by consuming excessive CPU resources...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

USN-9011-1 pyasn1 vulnerabilities

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service...

CVE-2026-116693

A flaw was found in dd-trace. A remote attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with a malicious URL query string. The default regular expression used to obfuscate query string metadata performs excessive backtracking during evaluation, consuming high...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-103880

A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service DoS by storing or verifying passwords hashed with an excessively high bcrypt work factor. Because the library fails to enforce an upper bound on computational cost during password...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-86463

A flaw was found in the Apache CXF Feed Item Query Language FIQL query parser, which can lead to a Denial of Service DoS. When evaluating query expressions, the parser attempts excessive combinations upon encountering long input strings lacking operators. A remote attacker can exploit this...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-116577

A flaw was found in Tornado. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted HTTP requests containing many folded header continuation lines. Processing these lines requires quadratic computational effort, consuming excessive CPU resources on the server's...

Datadog dd-trace resource management error vulnerability

Datadog dd-trace versions prior to 2.0.0 and from 5.131.1 up to 6.0.0 and from 6.20.1 up to 6.20.1 contain a resource management error vulnerability. This vulnerability arises because the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP regular expression performs excessive backtracking when processin...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

e-SIC Livre security vulnerability

Versions 0.2.2 and earlier of e-SIC Livre contain a security vulnerability. This vulnerability arises because the CAPTCHA image is generated without validating the user-supplied parameters l, a, tf, and ql in restrito/inc/captcha.php. As a result, remote attackers may cause a denial-of-service...