OESA-2026-4238 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

OESA-2026-4235 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

DoS (Denial of Service) io.netty:netty-handler Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N allows an...

BIT-GOLANG-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

BIT-GOLANG-2026-78667 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-19867

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

CVE-2026-19867

Mattermost versions 11.10.x <= 11.10.0 , 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , and 11.7.x

CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

CVE-2026-19867

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

EUVD-2026-102808

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Denial of Service vulnerability in Jackson Core (CVE-2026-18401)

Summary A security vulnerability CVE-2026-18401 has been identified in the Jackson Core library used by IBM Engineering Lifecycle Optimization - Engineering Publishing. The non-blocking async JSON parser fails to enforce the maxNumberLength constraint default: 1,000 characters defined in...

CLEANSTART-2026-WJ95486 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-BO67242 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CVE-2026-68906: Out-of-bounds Read

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

PT-2026-116169

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description Processing CSV input with carriage return CR only line endings using the getline function can lead to quadratic CPU usage. When the eol variable is unset, the parser treats CR-only input as a...

CVE-2026-110755: Inefficient Algorithmic Complexity

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

PT-2026-115519

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

CVE-2026-102834: Integer Overflow or Wraparound

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint...

CVE-2026-19867: Allocation of Resources Without Limits or Throttling

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...