re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...

SUSE-SU-2026:23073-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...

PT-2026-75921

Summary NonFinalizedState::handle reorg is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has no recursion depth limit and no cycle detection. A malicious or buggy validator can serve a block whose previous block hash poin...

The vulnerability of the bond_header_parse() function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the bondheaderparse function in the Linux operating system’s kernel is related to the execution of a loop with an unreachable exit condition „Infinite loop“. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-68499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern...

SUSE SLED15 / SLES15 Security Update : perl-XML-Bare (SUSE-SU-2026:3403-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3403-1 advisory. This update for perl-XML-Bare fixes the following issues - CVE-2026-13401: infinite loop when parsing malforme...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:21455-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21455-1 advisory. This update for amazon-ecs-init fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 inp...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

DEBIAN-CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

CVE-2026-68499 concerns the re2 Node.js bindings. Affected component is the String.prototype.match implementation in re2 when using a global RE2 pattern that can match the empty string. The underlying issue is that the native matching cursor is not advanced in lib/match.cc, causing an infinite lo...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

JLSEC-2026-967 ImageMagick has a possible infinite loop in its JPEG encoder when using `jpeg:extent`

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a continue statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger ...

JLSEC-2026-825

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file...

JLSEC-2026-1039 ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26...

JLSEC-2026-1023 ImageMagick has an Infinite Loop in subimage-search with crafted image

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in the subimage-search operation can happen when using a crafted image. This issue has been patched in versions 6.9.13-49 and 7.1.2-24...