CVE-2026-97491

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. When tearing down InfiniBand network connection paths, a shutdown worker thread may sleep indefinitely while waiting for pending operations to finish, blocking other work items in the queue. This condition can lead to...

CVE-2026-91867 Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread denial of service. Users are recommended to upgrade to version 3.2.4, which fixes thi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100384 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Use usbbulkmsgkillable with user-specified timeouts The usbtmc driver accepts timeou...

Denial Of Service (DoS)

nanoid is vulnerable to Denial Of Service. The vulnerability is due to an infinite loop in customAlphabet and customRandom when configured with a size of 0, allowing attacker-controlled input to hang the calling thread and cause application unavailability...

nanoid: nanoid: Denial of Service via infinite loop in random ID generation

A flaw was found in nanoid Nano ID, a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service DoS...

CVE-2026-64281

A flaw was found in the Linux kernel's svcrdma component. During transport teardown, threads waiting in svcrdmasqwait can hang indefinitely in an uninterruptible state. This occurs because these threads are not explicitly woken up when the transport closes, leading to them continuously holding...

PYSEC-2026-2907 PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

Summary MCPToolIndex.searchtools compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete...

CLSA-2026-1780055430 unbound: Fix of 3 CVEs

CVE-2026-42944: fix heap overflow when a query contains multiple NSID or PADDING EDNS options; only emit each option once per query via nsidseen / paddingseen guards COOKIE handler does not exist in 1.16.2 - CVE-2026-41292: cap parsed incoming EDNS options at 100 per query so a flood of options...

CVE-2026-43429

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Use usbbulkmsgkillable with user-specified timeouts The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usbbulkmsg calls. Since the user can specify...

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

Summary Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. Details The hang manifests as a userspace busy loop with SnappyStreamDecompressor.Decompress repeatedly calling Crc32CAlgorithm.Append. The exact...

EUVD-2020-6619

Malware in sbrugna...

EUVD-2022-1852

Malicious code in bioql PyPI...

CVE-2022-50193

CVE-2022-50193 concerns Linux kernel erofs: wake up all waiters after z_erofs_lzma_head is ready. The issue can cause the decompression thread to hang when mounting erofs a second time due to a sequence where Task A loads lzma config and fills z_erofs_lzma_head after Task B has already slept wait...

PT-2025-26119 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the erofs filesystem. The issue occurs when the user mounts the erofs filesystem for the second time, which may cause...

CVE-2005-4750

BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service server thread hang via unknown attack vectors...

Fugit security vulnerability

fugit is a floraison open source time tool for Ruby, rufus-scheduler and flor. A security vulnerability exists in versions of fugit prior to 1.11.1, which stems from improper user input length checking, and may result in a thread being occupied for an extended period of time without being able to...

CVE-2024-43380: Uncontrolled Resource Consumption

fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sigh...

AZL-67761 CVE-2024-35971 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang The ks8851irq thread may call ks8851rxpkts in case there are any packets in the MAC FIFO, which calls netifrx. This netifrx implementation is guarded by...

PT-2023-34081

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A potential issue exists where the md/raid1 thread is not stopped when the raid1 array run fails. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client

A flaw was found in jboss-remoting. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code,...