29490 matches found
CVE-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...
CVE-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...
CVE-2026-110688
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...
CVE-2026-53493
A flaw was found in containerd. During an image pull operation, containerd fails to enforce recursion and deduplication limits when traversing descriptor graphs in Open Container Initiative OCI image indexes. A remote attacker can exploit this flaw by serving a crafted image index, triggering...
EUVD-2026-104567
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...
CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...
CVE-2026-110688
The Cpanel::JSON::XS Perl module (versions 4.51 before 4.80) is vulnerable to quadratic CPU use due to an inefficient algorithmic complexity issue in the incr_parse function. The decoder revalidates the entire remaining buffer for UTF-8 encoding every time it encounters a non-ASCII byte in a stri...
CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...
CVE-2026-95838
A flaw was found in containerd. When unpacking image layers with specific file configurations such as opaque whiteout markers, the unpack handler performs repeated directory traversals. An attacker can exploit this by providing a maliciously crafted container image, leading to a Denial of Service...
Unchecked Input for Loop Condition
Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the processinlines function in src/rulescore/smartquotes.ts when the typographer option is enabled. The smartquotes rule performs a linear scan of...
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests...
OPENSUSE-RU-2026:22137-1 Recommended update for cadvisor
This update for cadvisor fixes the following issues: Changes in cadvisor: - CVE-2026-78669, bsc1285500, cadvisor: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes...
CLSA-2025-1757961506 kernel: Fix of 28 CVEs
posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - xfrm: state: fix out-of-bounds read during lookup CVE-2024-57982 - nfsd: fix race between laundromat and freestateid CVE-2024-50106 - nfsd: split scstatus out of sctype CVE-2024-50106 - nfsd: avoid race...
CVE-2026-112390: Loop with Unreachable Exit Condition
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...
PT-2026-117584
Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.51 through 4.79 Description An issue exists where the software allows quadratic CPU usage during the processing of non-ASCII JSON data. This occurs because the incr parse function decodes each buffered value using a...
Temporal Dynamics and Security Assessment of SRT Protocol: A 96-Day Longitudinal Analysis of Production Streaming Infrastructure
This study presents a 96-day longitudinal analysis of Secure Reliable Transport SRT protocol behavior in a production streaming environment between Iraq and Turkey, examining 262,672 transport metric samples and 5,033,104 system resource measurements collected between October 2025 and January 202...
PT-2026-117645
Name of the Vulnerable Software and Affected Versions Pillow versions 7.2.0 through 12.11.0 Description A flaw exists when processing MIC images, where the library can enter an infinite loop while determining the frame count. This occurs because MicImageFile inherits TIFF frame traversal, but...
CVE-2026-110688: Inefficient Algorithmic Complexity
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...
CVE-2026-98542
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...
UBUNTU-CVE-2026-98542
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...