CVE-2026-96418 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-96418 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-96418

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-96418

The Wireshark network protocol analyzer contains an infinite loop vulnerability within the TIFF protocol dissector affecting versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 . An attacker can exploit this flaw to cause a denial of service (DoS) . While the Kaspersky report mentions potential arbitrary...

DEBIAN-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

UBUNTU-CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

CLEANSTART-2026-MO36230 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the argo-workflows package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CVE-2026-97688: Loop with Unreachable Exit Condition

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.readchunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The...

Wireshark : CVE-2026-95394 : Microsoft Network Monitor file parser large loop

Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

Wireshark : CVE-2026-96418 : TIFF protocol dissector infinite loop

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-96421: Improperly Controlled Sequential Memory Allocation

USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-102253: Loop with Unreachable Exit Condition

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102761: Out-of-bounds Write

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

Amazon Linux 2 : python3-tornado (ALAS-2026-3924)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3924 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

Important: python3.13-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

Amazon Linux 2 : libpcap (ALAS-2026-3927)

The version of libpcap installed on the remote host is prior to 1.5.3-11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3927 advisory. In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit...