net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-86463

A flaw was found in the Apache CXF Feed Item Query Language FIQL query parser, which can lead to a Denial of Service DoS. When evaluating query expressions, the parser attempts excessive combinations upon encountering long input strings lacking operators. A remote attacker can exploit this...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

pillow: pillow: Denial of Service via duplicate page references in PDF files

A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing repeated references to the same page nodes, causing the...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-116577

A flaw was found in Tornado. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted HTTP requests containing many folded header continuation lines. Processing these lines requires quadratic computational effort, consuming excessive CPU resources on the server's...

Datadog dd-trace resource management error vulnerability

Datadog dd-trace versions prior to 2.0.0 and from 5.131.1 up to 6.0.0 and from 6.20.1 up to 6.20.1 contain a resource management error vulnerability. This vulnerability arises because the default DDTRACEOBFUSCATIONQUERYSTRINGREGEXP regular expression performs excessive backtracking when processin...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

libexpat: denial of service via crafted XML input

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

e-SIC Livre security vulnerability

Versions 0.2.2 and earlier of e-SIC Livre contain a security vulnerability. This vulnerability arises because the CAPTCHA image is generated without validating the user-supplied parameters l, a, tf, and ql in restrito/inc/captcha.php. As a result, remote attackers may cause a denial-of-service...

CVE-2026-114603

A flaw was found in opentelemetry-api. An unauthenticated remote attacker can cause a Denial of Service DoS by sending an HTTP request with a malformed tracing header containing an excessively long sequence of whitespace characters. Because the header parsing logic uses an inefficient regular...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...

CVE-2026-112891

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by providing a specially crafted image with an excessively large comment to an application that saves it as a GIF. Due to inefficient data copying while assembling image headers, processing such comments consumes...

Mattermost resource management error vulnerability

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, and 11.7.10 and earlier of 11.7.x series have a resource management vulnerability. This vulnerability arises from failing to limit the number and size of mentionkey...

Linux Distros Unpatched Vulnerability : CVE-2026-105399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers ca...

DEBIAN-CVE-2026-105399

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

EUVD-2026-95003

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : FreeType vulnerability (USN-8881-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8881-1 advisory. It was discovered that FreeType had a flaw in its CID font loader. An attacker could possibly use this issue to cause FreeType to consume...

USN-8881-1 freetype vulnerability

It was discovered that FreeType had a flaw in its CID font loader. An attacker could possibly use this issue to cause FreeType to consume excessive memory and CPU resources, leading to a denial of service...

CVE-2026-77387

A flaw was found in geopy. An attacker can cause a Denial of Service DoS by supplying excessively long or malformed coordinate strings to coordinate parsing functions such as Point.fromstring or reverse geocoding methods. Due to inefficient regular expression evaluation on unvalidated input,...