301 matches found
CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...
CVE-2026-106575
A flaw was found in ImageMagick. An attacker could provide a specially crafted Magick script that fails to release opened file pointers during execution. Repeated processing of such scripts can exhaust available file descriptors system resources used to manage open files, resulting in a Denial of...
CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...
CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...
CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...
Linux Distros Unpatched Vulnerability : CVE-2026-106575
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened fi...
CVE-2026-88252
A Denial of Service (DoS) vulnerability exists in sssd where a local user can exhaust the responder service's available file descriptors . By maintaining numerous concurrent connections to a responder socket and queuing new attempts, an attacker triggers an unthrottled retry loop . This results i...
CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion
A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...
CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion
A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: polkit (UTSA-2026-090653)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090653 advisory. There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtirpc (UTSA-2025-002260)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002260 advisory. In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This ca...
OESA-2026-3464 erlang security update
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Handling of Exceptional Conditions vulnerabili...
OESA-2026-3463 erlang security update
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Handling of Exceptional Conditions vulnerabili...
BIT-CONSUL-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...
JLSEC-2026-1289
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svcrun infinite loop without accepting new connections...
Linux Distros Unpatched Vulnerability : CVE-2026-15972
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptan...
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-15972
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...
UBUNTU-CVE-2026-15972
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...
