22910 matches found
CVE-2026-40014: Uncontrolled Resource Consumption
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...
CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...
CVE-2026-40014
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...
UBUNTU-CVE-2026-33607
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...
UBUNTU-CVE-2026-40014
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses js-yaml-4.1.1.tgz which is vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor component uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550, CVE-2026-59869. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser and...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which is vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed below in the Vulnerability Details section. This bulletin provides information about the affected components and the...
GHSA-8X48-8G7J-RQXP Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ww6m-cw3f-q94g. This link is maintained to preserve external references. Original Description nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of...
GHSA-HQV3-XM29-P9HQ Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that...
Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that...
PYSEC-2026-3752
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...
CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...
PYSEC-2026-3752
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...
Inefficient Algorithmic Complexity
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readblock method of TEICorpusView nltk/corpus/reader/pl196x.py, whose lazy .? whole-block regexes...
CVE-2026-81722
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...
PYSEC-2026-3738
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...
CVE-2026-81723
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected...
UBUNTU-CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...
PYSEC-2026-3961
opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...
CVE-2026-81722
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...