CVE-2026-50018

Hoverfly (open source API simulation tool) prior to version 1.12.8 is vulnerable to denial of service via a goroutine leak in its remote post-serve actions . The root cause is the use of http.DefaultClient without any timeout configuration: when the remote endpoint is unreachable or intentionally...

CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...

Allocation of Resources Without Limits or Throttling

Overview github.com/containerd/containerd/pkg/cri/server is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer an...

GHSA-7JXH-36Q5-GCQV containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the drainExecSyncIO function in internal/cri/server/containerexecsync.go, pkg/cri/server/containerexecsync.go, and pkg/cri/sbserver/containerexecsync.go. An attacker can cause...

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the drainExecSyncIO function in internal/cri/server/containerexecsync.go, pkg/cri/server/containerexecsync.go, and pkg/cri/sbserver/containerexecsync.go. An attacker can cause...

PT-2026-89204

Impact A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync...

EUVD-2026-67687

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235

filebrowser through 2.63.23 fails to validate named pipes in its directory archive and public download handlers. This causes blocking open syscalls that pin server goroutines and exhaust connection resources, resulting in a denial of service . Both authenticated users and anonymous visitors with ...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

Linux Distros Unpatched Vulnerability : CVE-2026-79778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transpo...

CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

CVE-2026-79778

rclone before v1.75.0 is affected by a denial of service vulnerability in the WebDAV TUS creation handler . The handler dereferences a nil response before checking for transport errors, meaning a malicious or compromised configured endpoint that resets connections during TUS uploads can trigger a...

CVE-2026-79778

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

EUVD-2026-65536

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

CVE-2026-73500

A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the tlsListener.acceptLoop to spawn an unbounded number of goroutines, which consume...

GO-2026-6107 Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3

In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking ma...