HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

EUVD-2026-63092

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing...

Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance

Summary Vulnerabilities identified in cyclops of IBM Netezza Appliance have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2026-59843 DESCRIPTION: A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in brace-expansion

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in brace-expansion. CVE-2026-69152 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-69152 DESCRIPTION: The brace-expansion library generates arbitrary...

Security update for wireshark

This update for wireshark fixes the following issues: CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector crash...

Security update for python-tornado6

This update for python-tornado6 fixes the following issue CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725. Patch Instructions: To install this SUSE update...

SUSE-SU-2026:4076-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

SUSE-SU-2026:4074-1 Security update for wget

This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962...

Security update for python-tornado

This update for python-tornado fixes the following issue: CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725. Patch Instructions: To install this SUSE update...

SUSE-SU-2026:4073-1 Security update for python-tornado

This update for python-tornado fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

MGASA-2026-0382 Updated tor packages fix security vulnerabilities

An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type CVE-2026-77642. A NULL write after free when sending a CONFLUXSWITCH cell fails, resulting in a crash CVE-2026-77641. An infinite loop when decompressing a truncated zlib/gzip stream with...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-3264)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 When processing HTTP/...

EulerOS 2.0 SP12 : glib-networking (EulerOS-SA-2026-3260)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-3339)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 When processing HTTP/...