AZL-108366 CVE-2026-110261 affecting package javapackages-bootstrap 1.14.0-4

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-101895

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

CVE-2026-110619

Versions frp 0.41.0 through 0.71.1 are vulnerable to a missing authentication flaw. The root cause is that pprof debug handlers are registered on the root mux outside of the Basic Authentication scope. This allows unauthenticated remote attackers to access /debug/pprof/ endpoints on frps dashboar...

CVE-2026-110596 quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110261

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-110261

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability caused by inefficient algorithmic complexity (CWE-407). When processing crafted class files using ClassWriter.COMPUTE_FRAMES , an attacker can supply methods that cause the MethodWriter.computeAllFrames() fix point algorithm to co...

CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2026-82617

A flaw was found in Apache OpenNLP. The built-in regular expression patterns used for identifying email and URL strings contain inefficient nested repetitions. A remote attacker can exploit this flaw by submitting crafted text to an affected application, triggering excessive CPU consumption or...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.4 (CPU)

Red Hat AI Base Images 3.5.4 CPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.6 (CPU)

Red Hat AI Base Images 3.3.6 CPU is now available. Red Hat® AI Base Images...

BIT-GITEA-2026-95112 Gitea issue reference parsing CPU exhaustion

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

BIT-ELASTICSEARCH-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service

Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...

CLEANSTART-2026-JN25142 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4633-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4633-1 advisory. - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130110 advisory. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Tenable has extracted the preceding description block...

PT-2026-114398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the reset per cpu data function within the drop monitor component. The issue occurs because the variable al includes the size of the struct nlattr a 4-by...

CVE-2026-110261: Inefficient Algorithmic Complexity

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

Linux Distros Unpatched Vulnerability : CVE-2026-110871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic...