PT-2025-29086 · Open Information Security Foundation +1 · Suricata +1

Name of the Vulnerable Software and Affected Versions: Suricata versions 7.0.10 and below Suricata versions 8.0.0-beta1 through 8.0.0-rc1 Description: Suricata, a network IDS, IPS, and NSM engine, is affected by an issue where mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory...

Medium: python3

Issue Overview: There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the...

Medium: python

Issue Overview: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. CVE-2025-6069 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Security update for helm-mirror

This update for helm-mirror fixes the following issues: CVE-2025-32386: Fixed denial of service due to memory exhaustion after loading a specially crafter chart bsc1241028 CVE-2025-32387: Fixed stack overflow due to parser recursion that can exceed the stack size limit bsc1241031 Patch...

Wikimedia Mediawiki - TitleIcon extension 安全漏洞

Wikimedia Mediawiki - TitleIcon extension is a title icon extension from the Wikimedia Foundation. A security vulnerability exists in Wikimedia Mediawiki - TitleIcon extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43.2, which stems from an uncleaned titleiconunicode parser...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in body-parser-1.20.0.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of body-parser-1.20.0.tgz Vulnerability Details CVEID:CVE-2024-45590 DESCRIPTION: body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious...

GHSA-W42R-MRX7-C633 LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...

LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...

PYSEC-2025-250

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

Security update for python39

This update for python39 fixes the following issues: CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupda...

OSV-2025-528 Heap-buffer-overflow in xmlnode_parser_structural_error_libxml

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429429092 Crash type: Heap-buffer-overflow WRITE 4 Crash state: xmlnodeparserstructuralerrorlibxml xmlRaiseError xmlParseAttValueInternal...

LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex version 0.12.21, which stems from an XML entity extension vulnerability in the sitemap parser that could lead to a denial of service attack...

FreeBSD : gstreamer1-plugins-bad -- stack buffer overflow in H.266 video parser (69bfe2a4-5a39-11f0-8792-4ccc6adda413)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 69bfe2a4-5a39-11f0-8792-4ccc6adda413 advisory. GStreamer Security Center reports: It is possible for a malicious third party to trigger a buffer...

Regular Expression Denial of Service (ReDoS)

Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the use of the regex /+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a non-matching...

Malicious code in old-header-parser (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 315f759e577d29f8c6922c09f69169b191d3c8886bae205c9d3925d4a366688d Any computer that has this package installed or running should be considered...

MAL-2025-5619 Malicious code in old-header-parser (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 315f759e577d29f8c6922c09f69169b191d3c8886bae205c9d3925d4a366688d Any computer that has this package installed or running should be considered...

AlmaLinux 9 : php:8.2 (ALSA-2025:7432)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7432 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decod...

MAL-2025-5583 Malicious code in solana-dextrade-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8f89467fb69d00785530ca32444043368fe523570c7f428d485319782d845a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in solana-dextrade-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8f89467fb69d00785530ca32444043368fe523570c7f428d485319782d845a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

com.fasterxml.jackson.core, jackson-core is vulnerable to Denial Of Service DoS. The vulnerability is due to missing depth constraints in the JSON parser, which allows recursive processing of deeply nested input without limits...