CVE-2026-103261: Allocation of Resources Without Limits or Throttling

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

PT-2026-105502

Summary Client.list parses the server's directory listing with the Unix-style parser in parseListUnix.js. Its RE LINE regex has two adjacent S+?:sS+ groups owner name, then group name followed by a required numeric size group. When a line starts with a valid listing prefix but the tokens after it...

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Summary HTTPServerRequest.init in tornado/httputil.py parses the URL query string via parseqsbytes with no field-count limit — while the sibling POST-body parsing path parsebodyarguments received a maxnumfields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed, explicitly ...

brace-expansion: brace-expansion: Denial of Service via crafted brace patterns

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive...

SUSE CVE-2026-102277

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...

SUSE CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

PT-2026-103794

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query...

Linux Distros Unpatched Vulnerability : CVE-2026-102277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function...

Linux Distros Unpatched Vulnerability : CVE-2026-102414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...

GHSA-Q2HR-2G5M-VWHR brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds vulnerability discovered by ? in WordPress Npm markdown-it versions 14.3.1...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

DEBIAN-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

UBUNTU-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

Important: python3.13-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...