CVE-2026-87079

The Net::IDN::Punycode Perl module, in versions prior to 2.590 , is vulnerable to CPU exhaustion due to a quadratic insertion cost during the decoding of long labels in decode_punycode. The XS backend scans a UTF-8 buffer from the start for every decoded code point, while the pure-Perl backend ma...

CVE-2026-87079 Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...

CVE-2026-21978

CVE-2026-21978 Oracle FLEXCUBE Universal Banking における私のCVE リンク: https://www.oracle.com/security-alerts/cpujan2026.html...

CVE-2026-81880: Uncontrolled Resource Consumption

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because the PEF loader accepted relocSecCount values that were not bounded by the number of sections or complete relocation records in t...

Linux Distros Unpatched Vulnerability : CVE-2026-87081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii...

SUSE SLES12: dovecot22 / dovecot22-backend-mysql / dovecot22-backend-pgsql / etc (SUSE-SU-2026:4271-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4271-1 advisory. This update for dovecot22 fixes the following issue: - CVE-2026-40016: Sieve :contains/:matches ONxM substring match bypasses sievemaxcputim...

CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

Linux Distros Unpatched Vulnerability : CVE-2026-87079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

CVE-2022-0778

CVE-2022-0778 説明 drago-96 のコンセプトを参考に、P12およびPEM形式に基づいてPoCを書き直しました。これを使用してCVE-2022-0778の脆弱性（つまり、危険なSSL証明書、秘密パスワードなしで空のまま）を検証できます。影響を受けるデバイスでは、プロセスのCPU使用率が100%になったり、再起動が発生する可能性があります。 クレジット https://github.com/drago-96/CVE-2022-0778 https://twitter.com/taviso https://github.com/wllm-rbnt/asn1template...

chronomaly-webos

Chronomaly — CVE-2025-38352 on LG webOS CVE-2025-38352（POSIX CPUタイマーの競合条件／use-after-free）を悪用したカーネルエクスプロイト。LG webOS Smart TV上で、ARM64のカーネル5.4.268で動作し、永続的なルート権限を取得します。複数のファームウェアバージョンを持つ4つのTVモデルで検証済み。LGのSecurity Researcher Programに責任を持って開示（2026年2月）。 farazsth98 によるChronomalyを基に構築。Stage...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

Important: Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (cpu)

Red Hat AI Inference 3.4.5 cpu is now available. Red Hat AI Inference...

CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2022-2588

CVE-2022-2588 하나의 CPU에 맞게 조정된 코드이며, 교육 목적으로 취약한 머신을 부팅할 수 있는 Vagrant 파일이 제공됩니다. 취약한 머신을 생성하려면 머신에 Vagrant가 설치되어 있어야 하며, 리포지토리 루트에서 다음을 실행하세요: root@kitploit: Vagrant up 설치 및 부팅을 기다린 후: root@kitploit: Vagrant ssh VM 내부: root@kitploit: cd CVE-2022-2588/ && gcc ./exploit.c -o exploit -lpthread...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...