net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-112891

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by providing a specially crafted image with an excessively large comment to an application that saves it as a GIF. Due to inefficient data copying while assembling image headers, processing such comments consumes...

NLnet Labs Unbound Resource Management Vulnerability

NLnet Labs Unbound versions 1.26.1 and earlier have a resource management vulnerability. This vulnerability stems from the lack of a overall budget limit on the incoming decompression workload. A large number of chained compression pointers can lead to excessive CPU usage. Attackers can exploit...

Crass : Large numeric exponents cause CPU and memory denial of service

Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...

GHSA-6WMF-3R64-VCWV Crass : Large numeric exponents cause CPU and memory denial of service

Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...

CVE-2026-93099

A flaw was found in the Linux kernel's fs/resctrl component. This use-after-free UAF vulnerability occurs when worker threads attempt to access memory that has already been released during CPU hotplug operations. A local attacker could potentially exploit this flaw to cause a system crash, leadin...

CVE-2026-92492

A flaw was found in the Linux kernel's cpufreq/amd-pstate component. A local attacker could potentially trigger a NULL pointer dereference by performing a racing CPU hotplug or driver teardown operation. This occurs because certain functions, amdpstatepowersupplynotifier and amdpstateprofileset, ...

CVE-2026-98471

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for AMD SEV Secure Encrypted Virtualization. During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not properly flushed before the system reclaims its memory. A loc...

CLEANSTART-2026-ER93144 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-NT55483 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-110688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An...

Linux Distros Unpatched Vulnerability : CVE-2026-112390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacke...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2026:1791840472)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791840472 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacke...

RHEL 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:80504)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80504 advisory. This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the nextobjectid function in src/PIL/PdfParser.py when saving a multi-frame image as a multi-page PDF using im.savefp, "PDF", saveall=True. The function computes the next PDF object ID by calling m...

CVE-2026-98542

A flaw was found in the Linux kernel's cpuset subsystem, which can lead to a denial of service DoS or compromised resource isolation. A local user with permissions to configure control groups cgroups can trigger this flaw by creating a remote partition that requests processor cores already...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...