CVE-2026-31899

CVE-2026-31899: Exponential DoS via Recursive Element Amplification in CairoSVG Keywords: CVE-2026-31899, CairoSVG, exponential DoS, SVG bomb, recursive use element, denial of service, XML amplification, Python SVG vulnerability, CWE-400, uncontrolled resource consumption, billion laughs SVG Tabl...

CVE-2026-77474

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

PT-2026-115657

destructive command guard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fixed an out-of-bounds shift in the exponential backoff mechanism. The ENA adapters on our instances occasionally reset. Recently, a UBSAN failure was logged on the console during this process: UBSAN: Out-of-bounds shif...

BIT-ELASTICSEARCH-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service

Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...

Elasticsearch 8.19.x < 8.19.22 / 9.1.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-189)

The version of Elasticsearch installed on the remote host is prior to 8.19.22, 9.4.8, or 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-189 advisory. - Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec. The vulnerabilities have been addressed. Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in...

CVE-2026-102408

Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...

CVE-2026-102408

Elasticsearch is vulnerable to a Denial of Service via Inefficient Regular Expression Complexity (CWE-1333) within the ES|QL CHUNK function 's recursive chunking strategy. The root cause is the lack of validation for computational complexity or execution time bounds on user-supplied regular expre...

CLEANSTART-2026-JM55948 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197...

CVE-2026-102408: Inefficient Regular Expression Complexity

Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...

Astra Linux – Vulnerability in node-brace-expansion

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion was vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provided a pattern containing repeated numeric brace ranges,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 security and extras update

Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...

Rocky Linux 10.2 [CIQ] Security Update: python-cryptography-debugsource / python3-cryptography / etc (crlsa-2026_71658)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202671658 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_47058)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202647058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

Rocky Linux 8 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2021_2569)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212569 advisory. libxml2: Use-after-free in xmlEncodeEntitiesInternal in entities.c CVE-2021-3516 libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal in...

Rocky Linux 10.2 [CIQ] Security Update: python3.14-cryptography / python3.14-cryptography-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_64795)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202664795 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 python-cryptography:...

Rocky Linux 10.2 [CIQ] Security Update: nodejs-nodemon (crlsa-2026_48032)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202648032 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 Tenable has extracted the preceding description block...

RLSA-2026:71658 Important: python-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...