CVE-2020-37280 cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

The cbor-sync library, versions through 1.0.4 , is vulnerable to a resource exhaustion attack within the CBOR.decode function. The root cause is that the component trusts declared array and map lengths without verifying the remaining input. An attacker can provide a small, crafted CBOR payload wi...

AZL-108072 CVE-2026-95838 affecting package kata-containers 4.1.0.kata0-1

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

AZL-108053 CVE-2026-95838 affecting package kata-containers-preview 3.27.0~preview2-2

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

RHLW-2026-F00B5FBBBB907153 Lightwell Security Advisory: netty-codec-xml 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-xml 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56817 and CVE-2026-73507. CVE-2026-56817: Netty: XML External Entity XXE injection via unconfigured XML factory when DTD and entity processing are enabled CVE-2026-73507: Netty:...

CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348

The Gitoxide gix-mailmap component (versions before 0.35.0 ) is vulnerable to a CPU Denial of Service via quadratic-time parsing in Snapshot::from_bytes . An attacker can commit a crafted .mailmap file with descending-ordered entries, triggering repeated front inserts that exhaust CPU resources. ...

CVE-2026-107378

A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.3 (CPU)

Red Hat AI Base Images 3.5.3 CPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.5 (CPU)

Red Hat AI Base Images 3.3.5 CPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

EulerOS 2.0 SP13 : patch (EulerOS-SA-2026-4080)

According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc (crlsa-2026_77648)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202677648 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

TencentOS Server 3: grafana-pcp (TSSA-2026:1135)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1135 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Amazon Linux 2 : rpcbind (ALAS-2026-3972)

The version of rpcbind installed on the remote host is prior to 0.2.0-45. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3972 advisory. A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by...

EulerOS 2.0 SP11 : patch (EulerOS-SA-2026-4356)

According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...