24209 matches found
PT-2026-59538
Summary The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth token is configured the default. By adding dangerous tool names e.g., shell exec, file write to the allowlist, an attacker can cause the ExecApprovalManager to...
PT-2026-59627
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. Patches This has been fixed in pypdf==6.7.2. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3655...
LifeOS 7.1.1
LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...
PT-2026-59630
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parse content stream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if th...
CVE-2026-51539
A Denial of Service DoS vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations...
PT-2026-59699
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently...
PT-2026-59640
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3839...
CVE-2026-51539: Uncontrolled Resource Consumption
A Denial of Service DoS vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations...
Linux Graphics Driver Heap Buffer Overflow DoS
The vulnerability of the amdgpupciSlotReset function in the drivers/gpu/drm/amd/amdgpu/amdgpudevice.c source code of the DRI support module for AMD GPU cores in Linux operating systems is related to the execution of a loop without sufficient restrictions on its execution count. Exploiting this...
ROS-20260713-73-0021
The vulnerability in python-pillow is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-59635
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. Patches This has been fixed in pypdf==6.7.1. Workarounds If you cannot upgrade yet, consider applying the changes...
PT-2026-59631
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...
PT-2026-59634
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. Patches This has been fixed in pypdf==6.9.2. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3693...
PT-2026-59032
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts including their request parameters and full TaskInstance details for DA...
PT-2026-59657
Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...
PT-2026-59644
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...
SUSE SLES15: terraform-provider-aws / terraform-provider-azurerm / etc (SUSE-SU-2026:2850-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2850-1 advisory. This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google,...
Uncontrolled Resource Consumption (Infinite Loop)
pypdf is vulnerable to Uncontrolled Resource Consumption Infinite Loop. The vulnerability is due to improper handling of crafted PDF files containing threads/articles during the merge operation, which allows an attacker to trigger an infinite loop by supplying a malicious PDF, resulting in a...
GHSA-CWC9-CP4J-MCVV libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There is no cap on how many IDs a single frame may contain. The default LP frame limit is 4MB, which fits roughly 180,000 message IDs. Iteratin...
