net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-77801

GitLab CE/EE versions from 12.8 before 19.1.7 , 19.2 before 19.2.5 , and 19.3 before 19.3.1 are affected by an Allocation of Resources Without Limits or Throttling issue. The root cause is missing object count limits in background job processing , which under certain conditions could allow an aut...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-76023

An improper resource control flaw was found in the Linux Toolkit Theming component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=545124048...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple uncontrolled resource consumption vulnerabilities due to pyasn1

Summary pyasn1 is used by IBM Integrated Analytics System as a generic ASN.1 library for Python, providing encoding and decoding of ASN.1 data structures. Multiple vulnerabilities affect pyasn1 versions prior to 0.6.4. CVE-2026-59884 involves the BER decoder accumulating long-form tag continuatio...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Integrated Analytics System as a web server and servlet container. Multiple vulnerabilities affect Jetty version 9.4.45.v20220203. CVE-2024-8184 and CVE-2023-26049 affect this version of Jetty and could allow attackers to gain access to sensitive information,...

kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

A resource exhaustion vulnerability was found in the Kernel Same-page Merging KSM subsystem of the Linux kernel. When scanning processes with large sparse virtual memory mappings e.g., 32 TiB with one mapped page, ksmd inefficiently walks every address rather than skipping unmapped holes. This...

SUSE CVE-2026-72009

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the oth...

SUSE CVE-2026-74279

In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi instead of listj when unmapping DMA buffers, leaking successfully mapped entries and repeatedly unmapping the failed one...

SUSE CVE-2026-74296

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one Free the UAR index returned by the hardware...

SUSE CVE-2026-74298

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

SUSE CVE-2026-74299

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 backlog tracking when a stream is reset. An attacker can exhaust system resources by repeatedly...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 backlog tracking when a...

EUVD-2026-66190

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Linux Distros Unpatched Vulnerability : CVE-2026-79289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendere...