python: Python unicodedata: Denial of Service due to excessive CPU consumption

A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...

CVE-2026-84997 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-81736 Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through...

CVE-2026-81736

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through...

EUVD-2026-80740

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through...

CVE-2026-81736

CVE-2026-81736 is a remote CPU denial of service in ISC BIND 9 . When a resolver has cached a tree of SVCB/HTTPS AliasMode records and receives a query for the root of that tree, it spends disproportionate CPU time constructing the response, leading to availability impact. Affected versions are 9...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-89927

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

DEBIAN-CVE-2026-89927

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

CVE-2026-89991

CVE-2026-89991 is a bug in the Linux kernel BPF subsystem affecting __pcpu_freelist_push(). When only one CPU is possible (e.g., CONFIG_SMP=n or nr_cpus=1), an NMI re-enters pcpu_freelist_push() while the interrupted context already holds that CPU's freelist lock. The fallback loop skips the curr...

CVE-2026-89927

CVE-2026-89927 is an integer overflow vulnerability in the Linux kernel's KVM x86 Hyper-V synthetic timer (stimer) emulation. When the STIMER COUNT MSR is programmed with a value close to U64_MAX , the deadline calculation overflows, producing a deadline in the past. This causes the hrtimer to fi...

EUVD-2026-80228

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...

CVE-2026-81872: Uncontrolled Resource Consumption

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

Linux Distros Unpatched Vulnerability : CVE-2026-81736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CP...

CVE-2026-77403: Allocation of Resources Without Limits or Throttling

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP...

microcode_ctl security, bug fix, and enhancement update

4:20260812-1.0.3 - disable late update for 06-ad-01 - add support for UEK7/UEK8 and ueknext kernels - don't bother calling dracut if virtualized Orabug: 35710077 - ensure UEK also rebuilds initramfs Orabug: 34280058 - add support for UEK7 kernels - enable early update for 06-4f-01 - remove no...

CVE-2026-81736: Excessive Platform Resource Consumption within a Loop

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through...

SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4145-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4145-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-c...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pyasn1 Vulnerability Details CVEID:CVE-2026-59884 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating...