CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api

The opentelemetry-api component in OpenTelemetry Python (prior to version 1.45.2 ) is vulnerable to a Denial of Service (DoS) via quadratic-time regular-expression backtracking. The issue occurs within TraceContextTextMapPropagator.extract() when processing a malformed traceparent value containin...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

Important: Red Hat Security Advisory: jackson-core security update

An update for jackson-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

CVE-2026-120217

A flaw was found in loguru. An inefficient regular expression in the ANSI color-markup parser can lead to a Denial of Service DoS. A remote attacker can exploit this vulnerability by submitting specially crafted input to the ANSI color-markup parser's AnsiParser.feed function, triggering excessiv...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_92408)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

Linux Distros Unpatched Vulnerability : CVE-2026-115866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line...

DEBIAN-CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl are vulnerable to CPU exhaustion due to regular expression backtracking during the decoding of chunked request bodies . The root cause is an inefficient regex where a run of hex digits followed by .* and a CRLF can trigger retries for every digit wh...

CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

PT-2026-133520

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

RockyLinux 10 : dogtag-pki (RLSA-2026:92408)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

AlmaLinux 10 : dogtag-pki (ALSA-2026:92408)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

GitPython: GitPython: Denial of Service via regular expression backtracking in date parsing

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

CVE-2026-116285

A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service DoS through excessive CPU consumption by submitting specially crafted chunked HTTP requests. This issue occurs due to quadratic regular expression backtracking when the parser processes malformed chunk-size lines...