CLEANSTART-2026-FO54280 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

PT-2026-108314

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server. This occurs when the peer opens a large number of streams and subsequently...

EulerOS 2.0 SP15 : patch (EulerOS-SA-2026-3998)

According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...

PT-2026-108125

Name of the Vulnerable Software and Affected Versions CairoSVG versions prior to 2.9.1 Description Rendering an attacker-controlled SVG containing a path with many segments can lead to quadratic CPU consumption. This occurs due to two issues in cairosvg/path.py: the path tokenizer repeatedly slic...

PT-2026-108313

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description Excessive CPU consumption occurs when parsing a Range header that contains a large number of small ranges. This issue affects the FileServerFS, ServeContent, and ServeFileFS functions...

CVE-2026-78667: Allocation of Resources Without Limits or Throttling

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-78669: Asymmetric Resource Consumption (Amplification)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219

The Excelize Go language library (versions 2.3.1 to 2.11.0 ) is vulnerable to an uncontrolled resource consumption flaw (CWE-400) during the OpenFile operation. The agileDecrypt function accepts an attacker-controlled spinCount from a crafted OLE encrypted-workbook header and passes it to convert...

CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-107212

The Excelize Go language library (versions 2.1.0 to 2.11.0 ) is vulnerable to a denial-of-service condition due to an unbounded row number in the Rows.Columns function. The vulnerability exists because Rows.Columns fails to apply the limit check enforced by Rows.Next , allowing it to accept look-...

Denial-of-service (DoS)

geopy is vulnerable to a Denial-of-service DoS. The vulnerability is due to excessive CPU consumption when parsing long, malformed coordinate strings, which allows an attacker to cause denial of service by repeatedly sending attacker-controlled requests containing crafted input...

EUVD-2026-93920

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

DEBIAN-CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...