SUSE-SU-2026:3684-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

CVE-2026-70656 Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...

CVE-2026-70656 Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...

SUSE-SU-2026:23250-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues in releases prior to...

SUSE CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

Linux Distros Unpatched Vulnerability : CVE-2026-77640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102063 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdifpassthruplaybackgetresources uses...

The vulnerability of the CoreDNS Loop Plugin in the coredns DNS server allows attackers to increase their privileges.

The vulnerability of the CoreDNS Loop Plugin in the coredns DNS server is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to increase their privileges...

CVE-2026-74431

A flaw was found in the Linux kernel's rxrpc network protocol implementation. This vulnerability could allow an attacker to trigger an infinite loop within the rxrpcrecvmsg function by manipulating out-of-band OOB queue handling. This could lead to a Denial of Service DoS condition, making the...

CVE-2026-74411

A flaw was found in the Linux kernel's rtw89 Wi-Fi driver. An incorrect data type used for a scan index during Wi-Fi scanning on the 6GHz band can lead to an infinite loop. This can cause a kernel soft lockup, making the CPU unresponsive and ultimately leading to a system panic, effectively...

DEBIAN-CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

EUVD-2026-63650

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

Tor before 0.4.9.9 is vulnerable to a denial of service when decompressing a truncated zlib/gzip stream with done=1. The root cause is in buf_add_compress() : a truncated stream never reaches Z_STREAM_END, so zlib returns Z_BUF_ERROR with no input remaining, which the function misinterpreted as a...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...