GHSA-HQV3-XM29-P9HQ Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that...

Duplicate Advisory: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp2x-qp44-57v7. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that...

EUVD-2026-67201

When a container-level ErrorHandler is configured the mitigation for finding 221000, each delivery whose processing throws still permanently consumes one link credit. After initialCredits default 100 failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the...

CVE-2026-59317

Spring for Apache Kafka is vulnerable to a denial of service via a poison-pill loop caused by missing header validation in DeadLetterPublishingRecovererFactory . The component reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new B...

CVE-2026-59317 In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

CVE-2026-59315

Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affected versions include Spring Cloud Config 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier . The vulnerability is scored CVSS 5.3 (Medium) with a network attack vector, low complexity,...

CVE-2026-59315 Spring Cloud Config Monitor Denial of Service

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

EUVD-2026-67197

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-19295

creationtimestamp| type| source ---|---|--- 2026-08-27 18:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/99985 2026-08-27 20:00:11+00:00| published-proof-of-concept| Telegram/tYXjtXGvZOcVL05bpL3O2jX-Uki9xdAhf7v1swcwhwyfI 2026-08-28 00:00:31+00:00| published-proof-of-concept|...

CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59289

CVE-2026-59289 affects Spring for GraphQL (versions 2.0.0–2.0.4, 1.4.0–1.4.6, 1.2.0–1.3.9) through a Denial of Service in its Spring Data pagination support. The root cause is that scrollable query arguments are resolved from client-supplied values and forwarded directly to the underlying reposit...

EUVD-2026-67178

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

EUVD-2026-67176

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59287

Spring for GraphQL versions 2.0.0–2.0.4, 1.4.0–1.4.6, and 1.3.0–1.3.9 are vulnerable to Denial of Service through the WebSocketGraphQlClient when the keepAlive option is enabled. An attacker who can interfere with the WebSocket connection—either by controlling the GraphQL server or via a Man-in-t...

CVE-2026-59287 Spring for GraphQL WebSocket Client Denial of Service

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59282 Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

EUVD-2026-67171

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

Spring Framework applications using its data binding infrastructure may be vulnerable to a Denial of Service via unbounded list growth. The root cause lies in the org.springframework:spring-beans package: an attacker can supply a crafted property path with a large index value, causing unbounded a...

CVE-2026-81724

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...