net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

ROS-20260907-73-0044

The vulnerability in Erlang is related to the lack of checks for the integrity of messages. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted TCP segments...

CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 are vulnerable to a path traversal (CWE-22) caused by insufficient validation of backslash-based dot-segments in proxied HTTP request paths. The plain HTTP handler skips the destination validation performed on the WebSocket path, and the underlying reply...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

PT-2026-84985

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-85124: Improper Limitation of a Pathname to a Restricted Directory

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

jdvrif — Updated!

jdvrif jdvrif JPG Data Vehicle , v9.0 is a fast, easy-to-use steganography command-line tool for concealing and extracting any file type via a JPG image. Linux only. Your data file is compressed with libdeflate/zlib , then encrypted with XChaCha20-Poly1305 libsodium secretstream under a key deriv...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

PT-2026-84503

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.12 through 4.13.4 Description The toSSG function fails to properly collapse consecutive parent-directory segments during static site generation. This occurs when the application uses ssgParams values that are not fully...

CVE-2026-79781

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to read and overwrite sensitive files outside of their intended directory by manipulating S3 object keys with 'dot-dot' segments e.g., ../. This could lead to unauthorized access and modification of critical...

EEF-CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields...

EUVD-2026-66469

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

AZL-97772 CVE-2026-80554 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

CVE-2026-80554

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...