DEBIAN-CVE-2026-90127

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal,...

CVE-2026-90127 virtio: rtc: time out alarm requests

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal,...

The vulnerability of the smux_accept() function in the SMUX module of the SNMP deployment and usage software Net-SNMP allows a attacker to cause a service failure.

The vulnerability of the smuxaccept function in the SMUX software module for SNMP protocol implementation and deployment is related to simultaneous access to a remote resource without a timeout mechanism. Exploiting this vulnerability could allow a malicious actor to cause service failure...

GHSA-7GHQ-V6JF-G56C Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

SUSE CVE-2026-26307

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources...

CVE-2026-71380

CVE-2026-71380 is a Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd . An unauthenticated remote attacker can trigger a denial of service by sending valid request headers declaring a large Content-Length and then stalling before the body is complete. In...

CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check

SummaryThe RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that...

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a HEAD request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controll...

GHSA-H9C5-X7G8-4Q7F Gitea git grep searches allow server resource exhaustion

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources...

EUVD-2026-19651

Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature...

Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout

Impact The HTTP Gateway processes headers, but with no timeout set. With a Slowloris attack, an attacker could cause Denial of Service DoS. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommende...

H2O 安全漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A security vulnerability exists in H2O version 3.46.0, which stems from a typeahead endpoint that does not set a timeout when verifying the presence of a specified resource, which could allow an attack...

CVE-2024-8061: Synchronous Access of Remote Resource without Timeout

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue...

netty: SniHandler 16MB allocation leads to OOM

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per...

CVE-2021-22139

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all...

rubygem-openshift-origin-node: cron.daily/cron.weekly denial of service

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly...