OESA-2026-1736 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.CVE-2026-32776 libexpat...

CLSA-2026-1774605210 expat: Fix of 2 CVEs

CVE-2026-32777: fix infinite loop while parsing DTD content - CVE-2026-32778: fix NULL pointer dereference in setContext on retry after OOM...

CVE-2026-33699

A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service DoS by consuming excessive system resources, making the application unresponsive. Mitigation To...

CVE-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

UBUNTU-CVE-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

ROS-20260327-73-0010

Vulnerability in python-rencode related to execution of a loop with an unreachable exit condition. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Digital Bazaar Forge security vulnerabilities

Digital Bazaar Forge is a native implementation of TLS in JavaScript by the American company Digital Bazaar. It is also an open-source tool used for developing encrypted and network-intensive web applications. Versions of Forge prior to 1.4.0 contained a security vulnerability caused by an infini...

CVE-2026-33891: Loop with Unreachable Exit Condition

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service DoS vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse function inherited from the bundled jsbn library...

CVE-2026-33750: Uncontrolled Resource Consumption

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value e.g., 1..2..0 causes the sequence generation loop to run indefinitely, making the process hang for seconds and...

CVE-2026-33699: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

Linux Kernel DRI DoS

The vulnerability of the mipidsiremovedevicefn function in the drivers/gpu/drm/drmmipidsi.c driver of the Direct Rendering Infrastructure DRI kernel of the Linux operating system is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerabilit...

Linux kernel trace ring buffer overflow DoS

The vulnerability of the rbresetcpu function in the kernel/trace/ringbuffer.c module, which supports Linux kernel tracing, is related to an infinite loop. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

CVE-2026-33699

CVE-2026-33699 affects the pypdf library (Python), with versions prior to 6.9.2 vulnerable to an infinite loop when reading a PDF in non-strict mode. The root cause is within DictionaryObject.read_from_stream processing, leading to potential hang. A fix is available in pypdf 6.9.2, and multiple O...

CVE-2026-33699 pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

CVE-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

CVE-2026-33699 pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

CVE-2026-33699 pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

CVE-2026-33699

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider...

AZL-81035 CVE-2026-33671 affecting package nodejs24 for versions less than 24.14.1-2

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as + and , especially when combined with overlapping...

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Summary A Denial of Service DoS vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse function inherited from the bundled jsbn library. When modInverse is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachab...