pypdf: Possible infinite loop for TreeObject.insert_child

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. PatchesThis has been fixed in pypdf==6.16.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from ...

PYSEC-2026-3913 pypdf: Possible infinite loop for TreeObject.insert_child

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. Patches This has been fixed in pypdf==6.16.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

SummaryTornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PYSEC-2026-3926 Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-88286

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

CVE-2026-88286 GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

CVE-2026-88286

GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPC2011) contains a denial of service vulnerability in its PTZ connection-state management . An unauthenticated remote client can exploit improper handling of PTZ connection state to block the accept loop , preventing new PTZ connections and effec...

CVE-2026-88286 GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

EUVD-2026-75320

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

PT-2026-89519

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without...

Linux Distros Unpatched Vulnerability : CVE-2026-89045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinit...

PT-2026-89327

🚨 HIGH Severity Alert CVE-2026-88286 | CVSS 7.5 GeoVision GV-LPC2211 V1.13 camera vulnerable to unauthenticated DoS attack on PTZ connections. Remote attackers can block new PTZ connections without authentication. Patch immediately. CVE PatchNow https://t.co/82pJfPEDwE...

PT-2026-89524

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

Python Library Tornado < 6.5.8 DoS (CVE-2026-82397)

The version of the Tornado Python package installed on the remote host is prior to 6.5.8. It is, therefore, affected by a denial of service vulnerability: - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded...

CVE-2026-89045: Loop with Unreachable Exit Condition

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...