CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-84305

sqlparse , a non-validating SQL parser for Python, is vulnerable to quadratic CPU consumption in versions prior to 0.6.0. When processing attacker-controlled parenthesized tuple lists via sqlparse.format(sql, reindent=True) or sqlformat --reindent, the ReindentFilter._get_offset() function in sql...

CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Jul 2026 - Includes OpenJDK July 2026

Summary Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Jul 2026 - Includes OpenJDK July 2026 CPU plus three additional vulnerabilities Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026

Summary Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU plus four additional vulnerabilities Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in...

USN-8712-1: pyasn1 vulnerabilities

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service...

CVE-2026-83612

A flaw was found in xmldom, a JavaScript module used for parsing HTML documents. This vulnerability allows a remote attacker to craft a malicious HTML document with specific mixed-case closing tags. When processed, this document can cause the parser to consume excessive CPU and memory, leading to...

CVE-2026-49329 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

DEBIAN-CVE-2026-83612

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

Security update for ucode-intel

This update for ucode-intel fixes the following issues: Intel CPU Microcode was updated to the 20260812 release bsc1274785 Removed MTL/06-aa-04/c0 due to functional issues observed when loading the MCU in some platforms. Intel CPU Microcode was updated to the 20260811 release bsc1274785 Security...

SUSE-SU-2026:3917-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: - Intel CPU Microcode was updated to the 20260812 release bsc1274785 - Removed MTL/06-aa-04/c0 due to functional issues observed when loading the MCU in some platforms. - Intel CPU Microcode was updated to the 20260811 release bsc1274785 -...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-83612 xmldom: HTML raw-text closing-tag case mismatch causes output amplification

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

CVE-2026-83612

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary serialize-javascript is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-34043. Vulnerability Details CVEID:CVE-2026-34043 DESCRIPTION: Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version...

CVE-2026-81723

A flaw was found in NLTK. This vulnerability, specifically in the XMLCorpusView.readxmlfragment function, allows a remote attacker to cause severe CPU consumption and a denial of service DoS by providing specially crafted, malformed XML corpus files. The flaw occurs because the system repeatedly...

CVE-2026-81725

A flaw was found in NLTK, specifically within the Pl196xCorpusReader component. A remote attacker can exploit this by supplying malformed Text Encoding Initiative TEI blocks containing numerous unmatched opening tags. This triggers a regular expression denial of service ReDoS vulnerability, causi...

CVE-2026-81722

A flaw was found in the nltk PorterStemmer component. A remote attacker could exploit this vulnerability by providing a specially crafted, untrusted token. The inefficient algorithmic complexity in the stemming process, specifically within the isconsonant and measure helper functions, causes...