net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

GHSA-37F3-6P89-6QR9 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Summary The regexreplace filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU...

EUVD-2026-67072

NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'...

NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...

GHSA-WW6M-CW3F-Q94G NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...

EUVD-2026-67073

NLTK: Quadratic CPU Exhaustion in XMLCorpusView.readxmlfragment...

GHSA-VP2X-QP44-57V7 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...

K000163180: BIND vulnerability CVE-2026-11605

Security Advisory Description The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG...

SUSE CVE-2026-74392

In the Linux kernel, the following vulnerability has been resolved: dm: limit target bio polling to one shot dmpollbio is the -pollbio callback for a stacked dm device. The caller only knows about the dm queue, so it may decide to do a spinning poll if it thinks a single queue is being polled...

DoS (Denial of Service) immutable.js Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability known as CVE-2026-59880 was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

SUSE CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

DoS (Denial of Service) io.netty:netty-codec Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vect...

Allocation of Resources Without Limits or Throttling

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. A...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings...