DEBIAN-CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

EUVD-2026-97650

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

AlmaLinux 9.2 [TuxCare] Security Update: runc (ALMALINUX9.2:CLSA-2026:1791543621)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791543621 advisory. - Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each ste...

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

CVE-2026-107378

The CairoSVG library, an SVG converter based on Cairo, is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.9.1 . The root cause is an inefficient algorithmic complexity (CWE-407) within cairosvg/path.py, where the path tokenizer repeatedly slices and rescans path data. Additi...

CVE-2026-107582

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

EUVD-2026-94864

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

CVE-2026-107582

Progressive Robot hMailServer versions 6.3.3 through 6.3.5 (REST API) and 6.2.22 through 6.3.5 (IMAP PREVIEW) are vulnerable to an inefficient algorithmic complexity flaw. The issue resides in the server's shared string class , where the replace and remove operations run in quadratic time . A rem...

CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...

DEBIAN-CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

EUVD-2026-93417

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-95112: Undefined Security Weakness

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

Rocky Linux 9.6 [TuxCare] Security Update: delve Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791279538)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791279538 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

PT-2026-106733

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description A denial-of-service issue exists in the django.utils.http.parse header parameters function. The problem arises from quadratic time...

AlmaLinux 9.6 [TuxCare] Security Update: delve Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791279538)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791279538 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...