Linux Distros Unpatched Vulnerability : CVE-2026-90420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: fix infinite loop in nilfscleansegments syzbot reported a hung task in nilfstransactionbegin. This occurs because the cleaner ioctl falls into an infini...

Linux Distros Unpatched Vulnerability : CVE-2026-93179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the curso...

EulerOS Virtualization 2.11.1 : python3 (EulerOS-SA-2026-3456)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods...

Linux Distros Unpatched Vulnerability : CVE-2026-62949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-90370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response...

Linux Distros Unpatched Vulnerability : CVE-2026-93153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-3742)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in Apache HTTP Server up to 2.4.67 Web Server and classified as critical.Using CWE to declare the problem leads to CWE-12...

CVE-2026-93690: Loop with Unreachable Exit Condition

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

Linux Distros Unpatched Vulnerability : CVE-2026-93065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC...

Linux Distros Unpatched Vulnerability : CVE-2026-90391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or...

Linux Distros Unpatched Vulnerability : CVE-2026-90088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame witho...

Linux Distros Unpatched Vulnerability : CVE-2026-93097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so...

EUVD-2026-80779

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the ChunkedDecoder::handleData process. An attacker can cause the process to enter an infinite loop and exhaust CPU resources by sending a malformed HTTP message with Transfer-Encoding: chunked that exploits specific...

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

GHSA-X424-64QH-5J54 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

EUVD-2026-80998

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service...

GHSA-GQ9C-WMRM-5HVR HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the inflate process in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java. An attacker can pin a JVM worker thread indefinitely by supplying a malformed Smart Health Card JWT with zip:"DEF" and a...