CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110688

The Cpanel::JSON::XS Perl module (versions 4.51 before 4.80) is vulnerable to quadratic CPU use due to an inefficient algorithmic complexity issue in the incr_parse function. The decoder revalidates the entire remaining buffer for UTF-8 encoding every time it encounters a non-ASCII byte in a stri...

EUVD-2026-104567

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

EUVD-2026-103195

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

Linux Distros Unpatched Vulnerability : CVE-2026-110755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110755

The Text::CSV_XS Perl module (versions before 1.65 ) is vulnerable to an inefficient algorithmic complexity (CWE-407) issue. When the eol option is unset, the getline function handles input with carriage return (CR) only line endings by copying the entire unparsed remainder into a new buffer for ...

PT-2026-116169

Text::CSV XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record th...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

GHSA-846F-F764-76MX Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

GHSA-57XR-HFXX-JW5X Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

CVE-2026-107833

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

UBUNTU-CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...