22015 matches found
CVE-2026-6554
A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial...
net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...
SUSE CVE-2026-6554
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely...
CVE-2026-88000: Loop with Unreachable Exit Condition
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...
The vulnerability of the netem_enqueue() function in the net/sched/sch_netem.c module of the Linux operating system’s network scheduling subsystem allows a attacker to cause a service failure.
The vulnerability of the netemenqueue function in the net/sched/schnetem.c module of the Linux operating system’s network scheduling subsystem is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploiting this vulnerability could allow a remote attacker t...
CVE-2026-88002: Loop with Unreachable Exit Condition
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...
The vulnerability of the TreeObject.insert_child() function in the Python library for working with PDF files, PyPDF, allows a hacker to cause a service failure.
The vulnerability of the TreeObject.insertchild function in the Python library for working with PDF files PyPDF is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the RoundCube Webmail email client, related to the execution of a loop with an unavailable exit condition, allows a hacker to cause a service failure.
The vulnerability of the RoundCube Webmail email client is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the function batadv_bla_send_claim() in the net/batman-adv/bridge_loop_avoidance.c module, which is part of the network functions of the Linux operating system’s kernel, allows a hacker to trigger a service failure.
The vulnerability of the batadvblasendclaim function in the net/batman-adv/bridgeloopavoidance.c module, which is part of the network functions of the Linux operating system’s kernel, relates to the use of pointers. Exploiting this vulnerability could allow a malicious actor to cause service...
The vulnerability of the rt6_fill_node() function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to cause a service failure.
The vulnerability of the rt6fillnode function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploitation of this vulnerability could allow a remote...
The vulnerability of the l2tp_session_unhash() function in the net/l2tp/l2tp_core.c module of the Linux operating system’s L2TP tunneling protocol implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the l2tpsessionunhash function in the net/l2tp/l2tpcore.c module of the Linux operating system’s L2TP tunneling protocol implementation is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerability could allow an...
The vulnerability of the cfg80211_merge_profile() function in the net/wireless/scan.c module of the Linux operating system’s wireless communication support allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the cfg80211mergeprofile function in the net/wireless/scan.c module related to Linux’s wireless communication support is associated with the execution of a loop with an unreachable exit condition an “infinite loop”. Exploiting this vulnerability could allow an attacker to...
CVE-2026-87013: Loop with Unreachable Exit Condition
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...
CVE-2026-87011: Asymmetric Resource Consumption (Amplification)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...
PT-2026-89177
Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...
EUVD-2026-67932
multer vulnerable to Denial of Service via oversized array index in field names...
EUVD-2026-69231
xmldom: Quadratic-time attribute deduplication...
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...