massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

EUVD-2026-91362

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...

CVE-2026-103880

The Apache Directory LDAP API is vulnerable to an Asymmetric Resource Consumption (CWE-405) issue. When a server supporting the bcrypt algorithm stores a password with a high cost factor (e.g., 30), the server CPU may run for hours during credential verification, potentially leading to a Denial o...

EUVD-2026-91359

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:4401-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4401-1 advisory. Security issues fixed: - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead ...

PYSEC-2026-4176 urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

urllib3: Chunked Deflate streaming can enter an infinite loop

Impacturllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once.urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

SummaryThere is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. DetailsThe problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

AlmaLinux 9.2 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.2:CLSA-2025:1765381441)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765381441 advisory. - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading t...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc Multiple Vulnerabilities (crlsa-2022_2199)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222199 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1758294053)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758294053 advisory. - The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers ca...

CentOS Linux 8.4 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.4:CLSA-2026:1777541752)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777541752 advisory. - If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1727979765)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1727979765 advisory. - There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during...

CentOS Linux 7 [TuxCare] Security Update: python3-pip Multiple Vulnerabilities (CENTOS7:CLSA-2026:1775723090)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1775723090 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1727289133)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1727289133 advisory. - There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CLEANSTART-2026-AJ28533 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the containerd package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...