EUVD-2026-58146

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755

Summary: CVE-2026-56755 is a DoS vulnerability in Gitea related to Denial of Service (CPU and memory exhaustion) caused by O(N^2) string concatenation during Debian package upload. The vulnerability is exploitable locally (attack vector: LOCAL) and is described with an impact of high availability...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-73556

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

EUVD-2026-58051

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

CVE-2026-70453

CVE-2026-70453 affects rsync before 3.5.0, where the hash_search() function has an algorithmic complexity vulnerability that enables a remote attacker to cause a denial of service by sending a carefully constructed file list. The vulnerability exploits quadratic-time worst-case hash lookups to ex...

CVE-2026-73507

Netty (async network framework) has a vulnerability in io.netty.handler.codec.xml.XmlFrameDecoder.decode() where the closing-tag parser state isn’t preserved across invocations. An unauthenticated remote attacker can send repeated

CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

EUVD-2026-58083

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

EUVD-2026-57759

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-18726

The CVE-2026-18726 issue affects open-iscsi (iscsiuio daemon). A crafted ICMPv6 Router Advertisement with a zero-length option can cause an infinite loop, leading to sustained CPU usage and DoS on the daemon, impacting system availability. A secondary risk of out-of-bounds reads may occur with a ...

next: Next.js: Denial of Service via malicious image optimization

A flaw was found in Next.js, a React framework. When self-hosting Next.js with the default image loader and configured to optimize remotely hosted images, a remote attacker could exploit the Image Optimization API. By providing malicious images, the attacker can cause CPU exhaustion, leading to a...

next: Next.js: Denial of Service via crafted requests to App Router with Server Actions

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...