CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

EUVD-2026-44406

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability...

CVE-2026-55831

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in...

CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in...

EUVD-2026-44392

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability...

EUVD-2026-44355

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53593

FreeScout prior to 1.8.224 is vulnerable to authenticated remote code execution due to an incomplete denylist for dangerous upload extensions. The upload endpoint POST /uploads/upload stores files with their original extension in storage/app/public/uploads/ and serves them at /storage/uploads/. O...

Tornado: Quadratic DoS via Crafted Multipart Parameters

Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...

Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...

EUVD-2025-203031

Tornado: Quadratic DoS via Repeated Header Coalescing...

EUVD-2025-203032

Tornado vulnerable to Header Injection and XSS via reason argument...

dotnet: .NET: Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service DoS. An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...

dotnet: .NET Framework: Denial of Service via network-based buffer overflow

A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service DoS, making the affected system unavailable to legitimate users...

dotnet: .NET Framework: Privilege escalation via code injection

A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected syste...

.NET: .NET: Network Spoofing Vulnerability

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...

dotnet: .NET Framework: Denial of Service via improper input validation

A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service DoS condition, making the affected system unavailable to legitimate users...

CVE-2026-64080

A flaw was found in the Linux kernel's ARM Firmware Framework for Arm FFA component. This vulnerability occurs because the system's notification handlers do not properly manage memory when processing callbacks. A timing issue can allow a callback to be unregistered and freed while it is still bei...