CVE-2026-61633

NanoMQ (MQTT broker) contains a flaw in its client-side function nni_mqtt_msg_decode_unsubscribe() in mqtt_codec.c. A malformed UNSUBSCRIBE packet with a zero-length topic followed by trailing data can cause a failed read_uint16() that leaves the buffer position unchanged while the topic count ke...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-93690

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

UBUNTU-CVE-2026-93690

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

CVE-2026-93690

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

EUVD-2026-82986

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

OPENSUSE-SU-2026:21879-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272118. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ss...

SUSE CVE-2026-89744

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...

SUSE CVE-2026-90053

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

SUSE CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

SUSE CVE-2026-90391

In the Linux kernel, the following vulnerability has been resolved: lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or dmirrordowrite finds a missing device page table entry. If the mirrored m...

SUSE CVE-2026-93097

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXLPOISONFLAGMORE set on every iteration never advances nrrecords, so the maxerrors guard never trips and the do/while loops forever while...

Linux Distros Unpatched Vulnerability : CVE-2026-90391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib/testhmm: fail dmirrorfault when the mirrored mm is gone dmirrorfault is called from the dmirrorread and dmirrorwrite retry loops after dmirrordoread or...

Linux Distros Unpatched Vulnerability : CVE-2026-93153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-3742)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in Apache HTTP Server up to 2.4.67 Web Server and classified as critical.Using CWE to declare the problem leads to CWE-12...

Linux Distros Unpatched Vulnerability : CVE-2026-93065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC...

CVE-2026-61633: Loop with Unreachable Exit Condition

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...