SUSE-SU-2026:4284-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-53109: net: tunnels: annotate lockless accesses to dev-neededheadroom bsc1242405 bsc1275784. - CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

EUVD-2026-84198

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-53109: net: tunnels: annotate lockless accesses to dev-neededheadroom bsc1242405 bsc1275784. CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944...

CVE-2026-88344

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with a digit, the integer digit-scan loop in lex advances past the end of the input buffer and dereferences the out-of-bounds pointer. A specially crafted schema...

PT-2026-96673

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An issue exists where the encode punycode function fails to validate if the input is well-formed UTF-8. When a string with the UTF-8 flag set over malformed bytes reaches the encoder, the...

SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:4270-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4270-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

ROS-20260922-73-0045

The vulnerability of the rt6fillnode function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploitation of this vulnerability could allow a remote...

SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:4272-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4272-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header. -...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090113)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090113 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding

A flaw was found in urllib3. A malicious server can trigger a Denial of Service DoS by returning a specially crafted compressed response containing trailing bytes. When streaming the response in chunks, the decompression logic can enter an infinite loop by repeatedly processing unconsumed data...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by a vulnerability in Go's HTTP/2 transport

Summary BM Optim versions 1.0.0, 1.1.0, and 1.2.0 include the Go net/http package, which is affected by a high-severity denial-of-service vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected Go dependency to a fixed version. Vulnerability Details CVEID:CVE-2026-338...

SUSE CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...