CVE-2026-90121: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without...

CVE-2026-86040: Uncontrolled Resource Consumption

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-85999: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

CVE-2026-90305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

CVE-2026-50277: Allocation of Resources Without Limits or Throttling

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

EulerOS 2.0 SP15 : glib-networking (EulerOS-SA-2026-3804)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...

CVE-2026-93168: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix CPU stall in xilinxdmapolltimeout Currently when calling xilinxdmapolltimeout with delayus=0 and a condition that is never fulfilled, the CPU busy-waits for prolonged time and the timeout triggers only...

CVE-2026-92492: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-82760: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ashauthentication/base.ex splits its argument into one...

RockyLinux 9 : microcode_ctl (RLSA-2026:68011)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:68011 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

CVE-2026-86000: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BatchingProcessor. An attacker can exhaust CPU resources and degrade or deny service by continuously filling the asynchronous export buffer while the exporter is backpressured...

CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

AZL-103113 CVE-2026-81872 affecting package azurelinux-image-tools 1.6.0-3

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

DEBIAN-CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-20154

A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device...

UBUNTU-CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

EUVD-2026-81261

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81872 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...