29569 matches found
EUVD-2026-95017
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
CVE-2026-105830 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
EUVD-2026-95003
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...
CVE-2026-105399 ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...
Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3
Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...
CLEANSTART-2026-VN37726 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations
CVE-2026-39820 affects multiple packages. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...
CLEANSTART-2026-RE57031 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...
CLEANSTART-2026-FO54280 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
PT-2026-108057
Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk of data arrives. A remote peer can exploit this by splitting a single valid MessagePack container...
RHLW-2026-5920E9C5F3ADA010 Lightwell Security Advisory: postgresql 42.7.3.rhlw-00001
Red Hat Lightwell has released org.postgresql:postgresql 42.7.3.rhlw-00001 with a backported security fix. CVE-2026-42198: pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.3 from...
PT-2026-107989
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
CVE-2026-107297: Inefficient Algorithmic Complexity
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed...
PT-2026-108112
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description An infinite loop exists in the ff rtsp connect function within libavformat/rtsp.c when processing RTSP 3xx redirects. Because the software does not implement a redirect limit, a malicious RTSP server...
CVE-2026-105830: Uncontrolled Resource Consumption
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...
PT-2026-108032
Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.6 Pydantic AI versions prior to 2.52.0 Description The local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during the conversion of HTML to Markdown. This occurs...
CVE-2026-107678: Uncontrolled Recursion
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...
PT-2026-109279
Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.x Description An issue exists in the JSON response body processor where the ProcessResponse function in internal/bodyprocessors/json.go fails to enforce a recursion limit. It passes a value of -1 to...
PT-2026-108125
Name of the Vulnerable Software and Affected Versions CairoSVG versions prior to 2.9.1 Description Rendering an attacker-controlled SVG containing a path with many segments can lead to quadratic CPU consumption. This occurs due to two issues in cairosvg/path.py: the path tokenizer repeatedly slic...
CVE-2026-107696: Loop with Unreachable Exit Condition
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects...