CVE-2026-90053: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

CVE-2026-90075: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return 0x80000000...

CVE-2026-90088: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

PT-2026-94768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An infinite loop exists in the nilfs2 file system within the nilfs clean segments function. This occurs when the cleaner ioctl is executed and the nilfs segctor construct function...

PT-2026-94718

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 mcu get chip config function within the mt76 wifi driver. The response Type-Length-Value TLV loop advances by the tlv-len value without a minimum threshold,...

PT-2026-94928

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPI subsystem for RISC-V architectures within the riscv acpi add prt dep function. The loop handling within this function incorrectly manages error conditions by...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service...

CVE-2026-92942: Uncontrolled Resource Consumption

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service...

PT-2026-94336

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions prior to 0.17.1 Description A reachable assertion issue exists in the DistServe decode migration loop. An unauthenticated attacker can terminate the inference engine by submitting a migration request containing an...

PT-2026-99487

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562150738 Crash type: UNKNOWN WRITE Crash state: av1 cdef mse calc frame mt av1 cdef search encode with recode loop and filter...

PT-2026-94975

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amd/powerplay component where the system fails to properly validate the usSize of voltage objects. When the VBIOS provides a malformed VoltageObjectInfo table,...

PT-2026-94863

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iwlwifi driver where the loop counter count in the iwl fwrt dump error logs function is declared as a u8 8-bit unsigned integer while the num pc variable is a u32...

CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the SSHMSGCHANNELOPEN and SSHMSGCHANNELOPENCONFIRMATION. An attacker can cause the asyncio event loop to freeze by supplying a sendpktsize value of zero, which leads to an infinite loop that prevents further processing ...

CVE-2026-62949

A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A malicious SSH server or an authenticated client can exploit this vulnerability by sending a specially crafted SSH packet with a zero-sized maximum packet size. This can cause the AsyncSSH event loop to freeze,...

UBUNTU-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...