MAL-2025-16631 Malicious code in cassini-ursa-sass-loader-stream (npm)

The package cassini-ursa-sass-loader-stream was found to contain malicious code...

MAL-2025-39328 Malicious code in winston-jest-webdriver-mocha-stream (npm)

The package winston-jest-webdriver-mocha-stream was found to contain malicious code...

MAL-2025-20778 Malicious code in forever-bellatrix-chromedriver-stream (npm)

The package forever-bellatrix-chromedriver-stream was found to contain malicious code...

MAL-2025-21134 Malicious code in galaxy-stream-query-astrometry (npm)

The package galaxy-stream-query-astrometry was found to contain malicious code...

MAL-2025-32612 Malicious code in sadr-radioastronomy-speleology-stream (npm)

The package sadr-radioastronomy-speleology-stream was found to contain malicious code...

MAL-2025-34080 Malicious code in stream-manager (npm)

The package stream-manager was found to contain malicious code...

MAL-2025-34083 Malicious code in stream-weywot-postcss-loader-version (npm)

The package stream-weywot-postcss-loader-version was found to contain malicious code...

MAL-2025-23645 Malicious code in jasmine-stream-element-ui-config (npm)

The package jasmine-stream-element-ui-config was found to contain malicious code...

MAL-2025-27630 Malicious code in node-log-stream (npm)

The package node-log-stream was found to contain malicious code...

CVE-2025-20109

Improper Isolation or Compartmentalization in the stream cache mechanism for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-55197

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are...

CVE-2025-55197 pypdf's Manipulated FlateDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are...

CVE-2025-55197

The CVE-2025-55197 issue affects pypdf prior to version 6.0.0, where a crafted PDF using a sequence of FlateDecode filters in a malicious cross-reference stream can exhaust RAM (DoS). Other content streams may be affected on explicit access. The vulnerability has been fixed in 6.0.0. A workaround...

GHSA-PRJ3-CCX8-P6X4 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.” MadeYouReset Vulnerability Summary The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to brea...

tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames

A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream...

CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

DEBIAN-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

ALPINE-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

UBUNTU-CVE-2025-8671

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS. By opening streams and then rapidly triggering the serv...

Denial of Service (DoS)

Overview amphp/http-server is a non-blocking HTTP application server for PHP based on Amp Affected versions of this package are vulnerable to Denial of Service DoS due to incorrect stream accounting in the handling of server-sent stream resets. An attacker can cause excessive server resource...