CVE-2026-84309 pypdf: Possible infinite loop for TreeObject.insert_child

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-84309

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

libssh: libssh: denial of service via zero advertised channel packet size

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

SUSE CVE-2026-59879

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 30 to 2 31 in setListBounds in src/List.js, causing an empty List to ente...

Security update for cups-filters

This update for cups-filters fixes the following issues: CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop bsc1273145. CVE-2026-64612: authenticated client that can submit an image print job can...

SUSE-SU-2026:3918-1 Security update for cups-filters

This update for cups-filters fixes the following issues: - CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop bsc1273145. - CVE-2026-64612: authenticated client that can submit an image print job...

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

SUSE-SU-2026:3916-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

SUSE CVE-2026-72193

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-59879

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

BIT-GITLAB-2025-10903 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the...

CVE-2026-40019

A flaw was found in Dovecot's ManageSieve login process. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted, truncated quoted argument. This action causes the process to enter an infinite loop, consuming excessive CPU resources. Repeated exploitation can lea...

CVE-2026-84309: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

Security Bulletin: IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214

Summary IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before 5.1.6 contains an infini...

SUSE CVE-2026-72166

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9clientrpc on fatal signal When p9clientrpc is called with type P9TFLUSH and the transport has no peer e.g. fd transport backed by pipes with no 9p server, a fatal signal causes an infinite loop:...

CVE-2026-80594

A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability allows a malicious device to trigger an infinite loop by providing a specially crafted descriptor with a zero-length field during the parsing of CDC union descriptors. This can lead to a Denial of Service DoS condition,...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

CVE-2026-82605

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The...

CVE-2026-82579

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...