CVE-2026-112322

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...

SUSE CVE-2026-121438

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

Linux Distros Unpatched Vulnerability : CVE-2026-121438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying...

DEBIAN-CVE-2026-121438

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438

The Mistune markdown library versions before 3.3.3 is vulnerable to a Denial of Service (DoS) condition in the InlineParser.parse_link function. The root cause is quadratic CPU growth triggered when parsing crafted Markdown containing thousands of balanced nested brackets that do not form valid l...

EUVD-2026-115860

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121438 Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

PT-2026-136195

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.3 Description A denial of service issue exists in the InlineParser.parse link function. An attacker can cause quadratic CPU growth by providing crafted Markdown containing thousands of balanced nested brackets tha...

CVE-2026-121438: lepture mistune: Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to…

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

SUSE SLED15 / SLES15 Security Update : python-CairoSVG (SUSE-SU-2026:4949-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4949-1 advisory. This update for python-CairoSVG fixes the following issue: - CVE-2026-107378: rendering an attacker-controlled SVG with...

openSUSE 16 Security Update : python-CairoSVG (openSUSE-SU-2026:22182-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22182-1 advisory. This update for python-CairoSVG fixes the following issue: - CVE-2026-107378: rendering an attacker-controlled SVG with a path containing many segments...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

Security update for python-CairoSVG (important)

openSUSE security update: security update for python-cairosvg ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22182-1 Rating: important References: bsc1284832 Cross-References: CVE-2026-107378 CVSS scores: CVE-2026-107378 SUSE : 7.5...

GHSA-FM9C-5RCF-2Q5P pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...

EUVD-2026-113350

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding...

pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...

Security update for python-CairoSVG

This update for python-CairoSVG fixes the following issue: CVE-2026-107378: rendering an attacker-controlled SVG with a path containing many segments can lead to quadratic CPU consumption bsc1284832. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...