Exploit for Unchecked Return Value in Google Brotli

CVE-2026-111497 Node2Shell Express body-parser Brotli DoS +...

CVE-2026-77620

A flaw was found in Vector's logstash source. An unauthenticated remote attacker can send specially crafted nested compressed frames. This can cause recursive decoding, leading to the exhaustion of the worker thread stack and amplification of decompressed input. Consequently, the process may...

CVE-2026-84181

A flaw was found in the Apache Camel Shiro component. The security processor fails to verify user credentials when an incoming request matches the identity of an authenticated user still associated with a reused worker thread. Under specific timing conditions, a remote attacker can exploit this...

CLEANSTART-2025-WC96717 With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created

Security vulnerability affects the nodejs package. With the aid of the diagnosticschannel utility, an event can be hooked into whenever a worker thread is created...

SUSE-SU-2026:4932-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check bsc1273133. - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remot...

AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793270033)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793270033 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an...

SUSE CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

DEBIAN-CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

AZL-111017 CVE-2026-110354 affecting package haproxy for versions less than 2.9.11-9

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-110354

HAProxy 3 versions prior to 3.4.6 are vulnerable to a denial of service (DoS) attack due to persistent worker-thread CPU exhaustion. The root cause involves an HTTP/1.1 chunked request where the parser repeatedly re-processes the same bytes without making progress, even after the H1 multiplexer d...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

CVE-2026-110354

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

Red Hat: CVE-2026-110354: haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

PT-2026-120965

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 3.4.6 Description A remote unauthenticated attacker can cause a denial of service leading to persistent worker-thread CPU exhaustion. This occurs when the system processes an HTTP/1.1 chunked request; the parser...

AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792597970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792597970 advisory. - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes...

Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the authenticateUser method in ShiroSecurityProcessor in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a princip...

haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service DoS by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the worker thread in...