CVE-2017-11499

Node.js 特定安全缺陷 常量哈希表种子 CVE-2017-11499 Node.js 曾容易受到哈希洪水远程拒绝服务攻击，因为哈希表种子在 Node.js 的特定发布版本中是常量。这是由于默认启用 V8 快照构建，导致初始随机种子在启动时被覆盖。感谢 Google Project Zero 的 Jann Horn 报告此漏洞。 你可以在此处阅读关于哈希洪水漏洞的一般类别：链接。 在此次更新中，快照已默认禁用。严重依赖 vm.runInNewContext 的代码很可能会遇到性能回归，直到实现更好的解决方案。 这是一个高严重性漏洞，影响所有活跃发布线（4.x、6.x、8.x）以及 7...

Important: python3.13

Issue Overview: tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the...

python: Fix of CVE-2026-7210

CVE-2026-7210: when hash randomization is enabled, seed libexpat's hash-flooding protection in pyexpat with a full 16 bytes of entropy via XMLSetHashSalt16Bytes, detected at runtime through a weak symbol so it activates once the system libexpat exposes it, instead of the 4-8 byte XMLSetHashSalt...

CPython 安全特征问题漏洞

CPython is a Python interpreter implemented in C language by the Python Foundation. CPython has a security feature vulnerability, which stems from insufficient entropy in Expat hash flood protection mechanisms. This vulnerability may allow specially crafted XML documents to trigger a hash flood...

UBUNTU-CVE-2026-41080

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document...

libexpat 安全漏洞

libexpat is a streaming XML parser written in C language by the libexpat team. Versions of libexpat prior to 2.7.6 had security vulnerabilities; these vulnerabilities were due to insufficient entropy, which could allow for hash flood attacks via specially crafted XML documents...