94038 matches found
CVE-2026-107227: Uncontrolled Resource Consumption
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames befor...
UBUNTU-CVE-2026-88252
A flaw was found in sssd. A local user can cause a Denial of Service...
CVE-2026-106123
The RabbitMQ Java client library allows Java and JVM-based application...
SUSE SLES15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat / etc (SUSE-SU-2026:4546-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4546-1 advisory. Security issues fixed: libtcnative-1-0: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to...
RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)
The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...
SUSE SLED15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat11 / etc (SUSE-SU-2026:4544-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4544-1 advisory. Security issues fixed: libtcnative-1-0: - CVE-2026-86243: buffer overread during the TLS handshake permits a...
CVE-2026-103006
A flaw was found in Elasticsearch. An authenticated remote user with read access can trigger excessive recursion by submitting a specially crafted search request with deeply nested aggregations. Processing this request exhausts server resources and causes the affected node to crash, resulting in ...
CVE-2026-103008
A flaw was found in Elasticsearch. An authenticated user with read access to an index can trigger unbounded recursion by submitting a request defining a scripted runtime field that generates deeply nested geometry structures. Because the server does not enforce a recursion depth limit when...
CVE-2026-102404
A flaw was found in Elasticsearch. An authenticated remote attacker with low privileges can submit a specially crafted query to the query processing engine, triggering excessive memory allocation. This uncontrolled memory growth leads to an out-of-memory crash that terminates the service node,...
CVE-2026-102408
A flaw was found in Elasticsearch. An authenticated attacker with read access to an index can cause a Denial of Service DoS by submitting queries containing specially crafted regular expressions to the ES|QL CHUNK function. Because the component does not properly restrict regular expression...
CVE-2026-80048 Sssd: sssd-kcm: local denial of service via excessive memory preallocation
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...
CVE-2026-80048
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 packages and security update
Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...
CVE-2026-105922
A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending manipulated input processed by the penalty handling mechanism. This triggers an unhandled failure in the token bin counting routine gettokenbincountsandmask, crashing the service and resulting in a Denial of...
CVE-2025-26466-msf
CVE-2025-26466 Metasploit module OpenSSH versions 9.5p1 to 9.9p1 is vulnerable to a memory and CPU exhaustion DoS Attack by sending repeated SSH2MSGPING packets type 192. This occurs before authentication, and can result in server lockup due to poor queue/buffer handling. More information about...
CVE-2026-104633
A flaw in Gitea allows for a Denial of Service (DoS) via memory exhaustion during repository migrations from another instance. The vulnerability occurs because Gitea relies on the source server's reported max_response_items (or max_response_items) to determine the end of paginated downloads. If a...
CVE-2022-36752
Description for CVE-2022-36752 png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted webp file when reversing the format back to png. Reproduction To reproduce the vulnerability, download the vulnerable version of...
cpython: Python HTMLParser quadratic complexity
A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...
python: Quadratic complexity in os.path.expandvars() with user-controlled template
A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...