AlmaLinux 9.6 [TuxCare] Security Update: patch Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784218870)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784218870 advisory. - GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handli...

The vulnerabilities of protocols such as BPv6, OpenFlow, and Kafka, as well as the Wireshark traffic analyzer for computer networks, allow attackers to cause service interruptions.

The vulnerability of Dissectors for protocols such as BPv6, OpenFlow, and Kafka, as well as the Wireshark traffic analyzer for computer networks, is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow a malicious actor to cause service...

ROS-20260930-73-0119

The vulnerability in the fs/smb/server/server.c component of the Linux operating system is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

AlmaLinux 9.6 [TuxCare] Security Update: openjpeg2 / openjpeg2-devel / openjpeg2-devel-docs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787149537)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787149537 advisory. - A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print...

Rocky Linux 9.6 [TuxCare] Security Update: openjpeg2 / openjpeg2-devel / openjpeg2-devel-docs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787149537)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787149537 advisory. - A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously prin...

GHSA-Q2HR-2G5M-VWHR brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

AZL-105051 CVE-2026-102253 affecting package iperf3 3.17.1-6

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

DEBIAN-CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

A flaw was found in iperf3. An unauthenticated remote attacker can exploit this issue by sending a crafted control-channel message followed by a specific User Datagram Protocol UDP datagram to the server. This causes the UDP receive processing thread to enter an unrecoverable infinite loop, leadi...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

Uncontrolled Resource Consumption

zstd-jni is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of negative length parameters in ZstdInputStreamNoFinalizer.read, which allows an attacker to trigger an infinite loop that holds the stream monitor and blocks other threads from accessing...

CVE-2025-6019_Exploit

CVE-2025-6019Exploit 1단계: Linux 장치에서 1.sh를 실행하여 xfs.image를 생성합니다. 2단계: xfs.image를 피해 장치로 전송하고 2.sh를 실행합니다. 아래와 같이 성공하면 됩니다. neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko 组=1001neko,11audio,12video,15cdrom,974ollama,997wheel,999plugdev,1002gamemode 'yes', Mapped file...

CVE-2026-102761

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...