Linux Distros Unpatched Vulnerability : CVE-2026-93153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and...

Linux Distros Unpatched Vulnerability : CVE-2026-93065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC...

Linux Distros Unpatched Vulnerability : CVE-2026-90088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame witho...

CVE-2026-93690: Loop with Unreachable Exit Condition

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-90053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bound...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-3742)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in Apache HTTP Server up to 2.4.67 Web Server and classified as critical.Using CWE to declare the problem leads to CWE-12...

EulerOS Virtualization 2.11.1 : python3 (EulerOS-SA-2026-3456)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods...

Linux Distros Unpatched Vulnerability : CVE-2026-90391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or...

Linux Distros Unpatched Vulnerability : CVE-2026-93097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so...

Linux Distros Unpatched Vulnerability : CVE-2026-93179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the curso...

EUVD-2026-80779

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU...

GHSA-X424-64QH-5J54 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the ChunkedDecoder::handleData process. An attacker can cause the process to enter an infinite loop and exhaust CPU resources by sending a malformed HTTP message with Transfer-Encoding: chunked that exploits specific...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

EUVD-2026-80998

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the inflate process in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java. An attacker can pin a JVM worker thread indefinitely by supplying a malformed Smart Health Card JWT with zip:"DEF" and a...

GHSA-GQ9C-WMRM-5HVR HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

Security Bulletin: nanoid-3.3.18.tgz (Publicly disclosed vulnerability found by Scanner)

Summary nanoid before 5.1.6/5.1.16 has infinite loops in customAlphabet/customRandom/nanoid non-secure when passed a size of 0 or negative value, hanging the calling thread and causing DoS. CVSS: 5.9 Medium, CWE-835. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before...