python-cryptography security update

An update is available for python-cryptography. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programmi...

RockyLinux 10 : python-cryptography (RLSA-2026:71658)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:71658 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 Tenable has extracted the...

CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

CVE-2026-87721

Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are vulnerable to Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g ). An unauthenticated remote attacker can trigger a persistent deni...

Important: Red Hat Security Advisory: python-cryptography security update

An update for python-cryptography is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: python-cryptography security update

An update for python-cryptography is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 10 : python-cryptography (RHSA-2026:71659)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71659 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

ALSA-2026:71658 Important: python-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 10 : python-cryptography (RHSA-2026:71658)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71658 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the normalization. An attacker can exhaust system resources by submitting a specially crafted WS-Policy document containing repeated policy references that trigger exponential...

CVE-2026-91865

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865

A flaw in Apache Neethi allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted WS-Policy document . The vulnerability is triggered when the document contains repeated policy references , forcing Neethi to re-expand these references exponentially during normal...

EUVD-2026-83887

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865 Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866: Allocation of Resources Without Limits or Throttling

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

Astra Linux – Vulnerability in cairosvg

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG, there was exponential denial of service due to recursive elements being amplified in the cairosvg/defs.py file. This caused CPU exhaustion with even small inputs...

Astra Linux – Vulnerability in libxml2

A flaw was discovered in libxml2. Exponential entity expansion could potentially bypass all existing protection mechanisms, leading to a denial of service...

Important: perl-YAML

Issue Overview: Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Affected Packages: perl-YAML Issue Correction: Run dnf update perl-YAML --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2151 --releasever 2023.12.20260914 to update your system. Mor...

Important: perl-YAML

Issue Overview: Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Affected Packages: perl-YAML Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...