CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-77)

Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker...

PT-2026-71762

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...

The vulnerability of the Linux operating system’s kernel, related to errors in thread locking, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-71794

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

Linux Distros Unpatched Vulnerability : CVE-2026-48802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessa...

CVE-2026-68334

A flaw was found in the Linux kernel's rxrpc component. A race condition in the rxrpcwakeupiothread function could lead to a null pointer dereference. This occurs when the iothread pointer is checked and then reloaded, and if the I/O thread exits between these operations, the second load can resu...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

Linux Distros Unpatched Vulnerability : CVE-2026-68334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess...

CVE-2026-48802

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

UBUNTU-CVE-2026-48802

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

EUVD-2026-56859

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

CVE-2026-48802

Summary (CVE-2026-48802, python-engineio): Before v4.13.2, a heartbeat-driven background thread could be created on new connections or PONG handling, causing DoS especially on synchronous servers. The fix in v4.13.2 changes the behavior so that the initial heartbeat background thread/async task i...

CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

CVE-2026-68095

A flaw was found in fuse-uring in the Linux kernel. A race condition exists between the registration of an I/O operation and the abortion of a FUSE connection. This can be triggered by a local attacker or a malicious application. This flaw can cause the unmount thread to hang indefinitely, leadin...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...