Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
446 vulnerabilities reference this CWE, most recent first.
CVE-2026-78132 (GCVE-0-2026-78132)
Vulnerability from cvelistv5 – Published: 2026-09-11 01:49 – Updated: 2026-09-14 18:18
VLAI
EPSS
VEX
Summary
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 15:10 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
mitre
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| strongSwan | strongSwan |
Affected:
5.1.3 , < 6.1.0
(semver)
cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T15:10:36.917536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:18:29.968Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "strongSwan",
"vendor": "strongSwan",
"versions": [
{
"lessThan": "6.1.0",
"status": "affected",
"version": "5.1.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0",
"versionStartIncluding": "5.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin\u0027s attribute certificate parser for\u00a0ietfAttrSyntax."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T01:49:15.049Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html"
},
{
"url": "https://github.com/strongswan/strongswan/releases/tag/6.1.0"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-78132",
"datePublished": "2026-09-11T01:49:15.049Z",
"dateReserved": "2026-08-22T23:35:56.619Z",
"dateUpdated": "2026-09-14T18:18:29.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78129 (GCVE-0-2026-78129)
Vulnerability from cvelistv5 – Published: 2026-09-11 01:40 – Updated: 2026-09-11 14:16
VLAI
EPSS
VEX
Summary
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 14:16 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
mitre
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| strongSwan | strongSwan |
Affected:
4.6.2 , < 6.1.0
(semver)
cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:16:33.445371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:16:41.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "strongSwan",
"vendor": "strongSwan",
"versions": [
{
"lessThan": "6.1.0",
"status": "affected",
"version": "4.6.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0",
"versionStartIncluding": "4.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T01:40:01.247Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/strongswan/strongswan/releases/tag/6.1.0"
},
{
"url": "https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-78129",
"datePublished": "2026-09-11T01:40:01.247Z",
"dateReserved": "2026-08-22T23:30:57.401Z",
"dateUpdated": "2026-09-11T14:16:41.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77117 (GCVE-0-2026-77117)
Vulnerability from cvelistv5 – Published: 2026-09-15 10:48 – Updated: 2026-09-15 12:26
VLAI
EPSS
VEX
Title
SHIFT_JISX0213 decoding may hang on crafted input
Summary
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.
Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 12:26 UTC
CWE
- CWE-835 - Loop with unreachable exit condition ('infinite loop')
Assigner
glibc
CNA
References
2 references
| URL | Tags |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=34556 | issue-tracking |
| https://sourceware.org/git/?p=glibc.git;a=blob_pl… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| The GNU C Library | glibc |
Affected:
2.3 , ≤ 2.44
(custom)
|
Date Public
2026-08-21 04:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T12:26:20.894498Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T12:26:33.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "glibc",
"vendor": "The GNU C Library",
"versions": [
{
"lessThanOrEqual": "2.44",
"status": "affected",
"version": "2.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AISLE in partnership with Red Hat"
}
],
"datePublic": "2026-08-21T04:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\u003cbr\u003e\u003cbr\u003eSome SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."
}
],
"value": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T10:48:56.375Z",
"orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
"shortName": "glibc"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34556"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SHIFT_JISX0213 decoding may hang on crafted input",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
"assignerShortName": "glibc",
"cveId": "CVE-2026-77117",
"datePublished": "2026-09-15T10:48:56.375Z",
"dateReserved": "2026-08-20T12:24:17.417Z",
"dateUpdated": "2026-09-15T12:26:33.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76445 (GCVE-0-2026-76445)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:14 – Updated: 2026-10-22 19:11
VLAI
EPSS
VEX
Title
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Summary
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 17:16 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
cisco
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Open Source Snort3 |
Affected:
3.12.2.0
Affected: 3.1.2.0 Affected: 3.1.3.0 Affected: 3.1.4.0 Affected: 3.1.5.0 Affected: 3.1.6.0 Affected: 3.1.7.0 Affected: 3.1.8.0 Affected: 3.1.9.0 Affected: 3.1.10.0 Affected: 3.1.12.0 Affected: 3.1.13.0 Affected: 3.1.14.0 Affected: 3.1.15.0 Affected: 3.1.16.0 Affected: 3.1.17.0 Affected: 3.1.18.0 Affected: 3.1.19.0 Affected: 3.1.20.0 Affected: 3.1.21.0 Affected: 3.1.22.0 Affected: 3.1.23.0 Affected: 3.1.24.0 Affected: 3.1.25.0 Affected: 3.1.27.0 Affected: 3.1.28.0 Affected: 3.1.29.0 Affected: 3.1.30.0 Affected: 3.1.31.0 Affected: 3.1.32.0 Affected: 3.1.36.0 Affected: 3.1.38.0 Affected: 3.1.39.0 Affected: 3.1.40.0 Affected: 3.1.41.0 Affected: 3.1.42.0 Affected: 3.1.43.0 Affected: 3.1.45.0 Affected: 3.1.47.0 Affected: 3.1.48.0 Affected: 3.1.50.0 Affected: 3.1.51.0 Affected: 3.1.52.0 Affected: 3.1.53.0 Affected: 3.1.55.0 Affected: 3.1.56.0 Affected: 3.1.57.0 Affected: 3.1.58.0 Affected: 3.1.59.0 Affected: 3.1.60.0 Affected: 3.1.61.0 Affected: 3.1.62.0 Affected: 3.1.63.0 Affected: 3.1.64.0 Affected: 3.1.65.0 Affected: 3.1.66.0 Affected: 3.1.67.0 Affected: 3.1.69.0 Affected: 3.1.70.0 Affected: 3.1.71.0 Affected: 3.1.72.0 Affected: 3.1.73.0 Affected: 3.1.74.0 Affected: 3.1.75.0 Affected: 3.1.76.0 Affected: 3.1.77.0 Affected: 3.1.78.0 Affected: 3.1.81.0 Affected: 3.1.82.0 Affected: 3.1.83.0 Affected: 3.1.84.0 Affected: 3.2.1.0 Affected: 3.2.2.0 Affected: 3.3.0.0 Affected: 3.3.1.0 Affected: 3.3.2.0 Affected: 3.3.3.0 Affected: 3.3.4.0 Affected: 3.3.5.0 Affected: 3.3.7.0 Affected: 3.5.0.0 Affected: 3.5.1.0 Affected: 3.8.1.0 Affected: 3.6.0.0 Affected: 3.6.2.0 Affected: 3.9.3.0 Affected: 3.7.2.0 Affected: 3.7.0.0 Affected: 3.9.6.0 Affected: 3.10.0.0 Affected: 3.10.2.0 Affected: 3.7.4.0 Affected: 3.9.0.0 Affected: 3.5.2.0 Affected: 3.12.1.0 Affected: 3.6.1.0 Affected: 3.9.2.0 Affected: 3.6.3.0 Affected: 3.9.5.0 Affected: 3.7.1.0 Affected: 3.9.7.0 Affected: 3.7.3.0 Affected: 3.10.1.0 Affected: 3.9.1.0 Affected: 3.11.1.0 |
|
| Cisco | Cisco Secure Firewall Threat Defense (FTD) Software |
Affected:
7.0.0
Affected: 7.0.0.1 Affected: 7.0.1 Affected: 7.0.1.1 Affected: 7.0.2 Affected: 7.2.0 Affected: 7.0.2.1 Affected: 7.0.3 Affected: 7.2.0.1 Affected: 7.0.4 Affected: 7.2.1 Affected: 7.0.5 Affected: 7.3.0 Affected: 7.2.2 Affected: 7.2.3 Affected: 7.3.1 Affected: 7.2.4 Affected: 7.0.6 Affected: 7.2.5 Affected: 7.2.4.1 Affected: 7.3.1.1 Affected: 7.4.0 Affected: 7.0.6.1 Affected: 7.2.5.1 Affected: 7.4.1 Affected: 7.2.6 Affected: 7.0.6.2 Affected: 7.4.1.1 Affected: 7.2.7 Affected: 7.2.5.2 Affected: 7.3.1.2 Affected: 7.2.8 Affected: 7.6.0 Affected: 7.4.2 Affected: 7.2.8.1 Affected: 7.0.6.3 Affected: 7.4.2.1 Affected: 7.2.9 Affected: 7.0.7 Affected: 7.7.0 Affected: 7.4.2.2 Affected: 7.2.10 Affected: 7.6.1 Affected: 7.4.2.3 Affected: 7.0.8 Affected: 7.6.2 Affected: 7.7.10 Affected: 7.7.11 Affected: 7.0.8.1 Affected: 7.6.2.1 Affected: 7.7.10.1 Affected: 7.4.2.4 Affected: 7.2.10.2 Affected: 7.4.3 Affected: 7.6.4 Affected: 10.0.0 Affected: 7.4.4 Affected: 7.0.9 Affected: 7.2.11 Affected: 7.4.7 |
|
| Cisco | Cisco UTD SNORT IPS Engine Software |
Affected:
17.12.1a
Affected: 17.12.2 Affected: 17.12.3 Affected: 17.12.4 Affected: 17.12.3a Affected: 17.15.1a Affected: 17.12.4a Affected: 17.15.2c Affected: 17.12.4b Affected: 17.15.2a Affected: 17.12.5 Affected: 17.12.5a Affected: 17.15.3a Affected: 17.15.3 Affected: 17.12.5b Affected: 17.12.5c Affected: 17.15.4 Affected: 17.18.1 Affected: 17.18.1a Affected: 17.12.6 Affected: 17.15.4c Affected: 17.12.5d Affected: 17.18.2 Affected: 17.15.5 Affected: 17.15.5a Affected: 17.12.7 Affected: 17.12.7a Affected: 17.12.7b Affected: 17.18.3a Affected: 17.12.8 Affected: 17.15.6 Affected: 17.18.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T17:16:58.668961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:54.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Open Source Snort3",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "3.12.2.0"
},
{
"status": "affected",
"version": "3.1.2.0"
},
{
"status": "affected",
"version": "3.1.3.0"
},
{
"status": "affected",
"version": "3.1.4.0"
},
{
"status": "affected",
"version": "3.1.5.0"
},
{
"status": "affected",
"version": "3.1.6.0"
},
{
"status": "affected",
"version": "3.1.7.0"
},
{
"status": "affected",
"version": "3.1.8.0"
},
{
"status": "affected",
"version": "3.1.9.0"
},
{
"status": "affected",
"version": "3.1.10.0"
},
{
"status": "affected",
"version": "3.1.12.0"
},
{
"status": "affected",
"version": "3.1.13.0"
},
{
"status": "affected",
"version": "3.1.14.0"
},
{
"status": "affected",
"version": "3.1.15.0"
},
{
"status": "affected",
"version": "3.1.16.0"
},
{
"status": "affected",
"version": "3.1.17.0"
},
{
"status": "affected",
"version": "3.1.18.0"
},
{
"status": "affected",
"version": "3.1.19.0"
},
{
"status": "affected",
"version": "3.1.20.0"
},
{
"status": "affected",
"version": "3.1.21.0"
},
{
"status": "affected",
"version": "3.1.22.0"
},
{
"status": "affected",
"version": "3.1.23.0"
},
{
"status": "affected",
"version": "3.1.24.0"
},
{
"status": "affected",
"version": "3.1.25.0"
},
{
"status": "affected",
"version": "3.1.27.0"
},
{
"status": "affected",
"version": "3.1.28.0"
},
{
"status": "affected",
"version": "3.1.29.0"
},
{
"status": "affected",
"version": "3.1.30.0"
},
{
"status": "affected",
"version": "3.1.31.0"
},
{
"status": "affected",
"version": "3.1.32.0"
},
{
"status": "affected",
"version": "3.1.36.0"
},
{
"status": "affected",
"version": "3.1.38.0"
},
{
"status": "affected",
"version": "3.1.39.0"
},
{
"status": "affected",
"version": "3.1.40.0"
},
{
"status": "affected",
"version": "3.1.41.0"
},
{
"status": "affected",
"version": "3.1.42.0"
},
{
"status": "affected",
"version": "3.1.43.0"
},
{
"status": "affected",
"version": "3.1.45.0"
},
{
"status": "affected",
"version": "3.1.47.0"
},
{
"status": "affected",
"version": "3.1.48.0"
},
{
"status": "affected",
"version": "3.1.50.0"
},
{
"status": "affected",
"version": "3.1.51.0"
},
{
"status": "affected",
"version": "3.1.52.0"
},
{
"status": "affected",
"version": "3.1.53.0"
},
{
"status": "affected",
"version": "3.1.55.0"
},
{
"status": "affected",
"version": "3.1.56.0"
},
{
"status": "affected",
"version": "3.1.57.0"
},
{
"status": "affected",
"version": "3.1.58.0"
},
{
"status": "affected",
"version": "3.1.59.0"
},
{
"status": "affected",
"version": "3.1.60.0"
},
{
"status": "affected",
"version": "3.1.61.0"
},
{
"status": "affected",
"version": "3.1.62.0"
},
{
"status": "affected",
"version": "3.1.63.0"
},
{
"status": "affected",
"version": "3.1.64.0"
},
{
"status": "affected",
"version": "3.1.65.0"
},
{
"status": "affected",
"version": "3.1.66.0"
},
{
"status": "affected",
"version": "3.1.67.0"
},
{
"status": "affected",
"version": "3.1.69.0"
},
{
"status": "affected",
"version": "3.1.70.0"
},
{
"status": "affected",
"version": "3.1.71.0"
},
{
"status": "affected",
"version": "3.1.72.0"
},
{
"status": "affected",
"version": "3.1.73.0"
},
{
"status": "affected",
"version": "3.1.74.0"
},
{
"status": "affected",
"version": "3.1.75.0"
},
{
"status": "affected",
"version": "3.1.76.0"
},
{
"status": "affected",
"version": "3.1.77.0"
},
{
"status": "affected",
"version": "3.1.78.0"
},
{
"status": "affected",
"version": "3.1.81.0"
},
{
"status": "affected",
"version": "3.1.82.0"
},
{
"status": "affected",
"version": "3.1.83.0"
},
{
"status": "affected",
"version": "3.1.84.0"
},
{
"status": "affected",
"version": "3.2.1.0"
},
{
"status": "affected",
"version": "3.2.2.0"
},
{
"status": "affected",
"version": "3.3.0.0"
},
{
"status": "affected",
"version": "3.3.1.0"
},
{
"status": "affected",
"version": "3.3.2.0"
},
{
"status": "affected",
"version": "3.3.3.0"
},
{
"status": "affected",
"version": "3.3.4.0"
},
{
"status": "affected",
"version": "3.3.5.0"
},
{
"status": "affected",
"version": "3.3.7.0"
},
{
"status": "affected",
"version": "3.5.0.0"
},
{
"status": "affected",
"version": "3.5.1.0"
},
{
"status": "affected",
"version": "3.8.1.0"
},
{
"status": "affected",
"version": "3.6.0.0"
},
{
"status": "affected",
"version": "3.6.2.0"
},
{
"status": "affected",
"version": "3.9.3.0"
},
{
"status": "affected",
"version": "3.7.2.0"
},
{
"status": "affected",
"version": "3.7.0.0"
},
{
"status": "affected",
"version": "3.9.6.0"
},
{
"status": "affected",
"version": "3.10.0.0"
},
{
"status": "affected",
"version": "3.10.2.0"
},
{
"status": "affected",
"version": "3.7.4.0"
},
{
"status": "affected",
"version": "3.9.0.0"
},
{
"status": "affected",
"version": "3.5.2.0"
},
{
"status": "affected",
"version": "3.12.1.0"
},
{
"status": "affected",
"version": "3.6.1.0"
},
{
"status": "affected",
"version": "3.9.2.0"
},
{
"status": "affected",
"version": "3.6.3.0"
},
{
"status": "affected",
"version": "3.9.5.0"
},
{
"status": "affected",
"version": "3.7.1.0"
},
{
"status": "affected",
"version": "3.9.7.0"
},
{
"status": "affected",
"version": "3.7.3.0"
},
{
"status": "affected",
"version": "3.10.1.0"
},
{
"status": "affected",
"version": "3.9.1.0"
},
{
"status": "affected",
"version": "3.11.1.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.2.10.2"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.6.4"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.0.9"
},
{
"status": "affected",
"version": "7.2.11"
},
{
"status": "affected",
"version": "7.4.7"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco UTD SNORT IPS Engine Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "17.12.1a"
},
{
"status": "affected",
"version": "17.12.2"
},
{
"status": "affected",
"version": "17.12.3"
},
{
"status": "affected",
"version": "17.12.4"
},
{
"status": "affected",
"version": "17.12.3a"
},
{
"status": "affected",
"version": "17.15.1a"
},
{
"status": "affected",
"version": "17.12.4a"
},
{
"status": "affected",
"version": "17.15.2c"
},
{
"status": "affected",
"version": "17.12.4b"
},
{
"status": "affected",
"version": "17.15.2a"
},
{
"status": "affected",
"version": "17.12.5"
},
{
"status": "affected",
"version": "17.12.5a"
},
{
"status": "affected",
"version": "17.15.3a"
},
{
"status": "affected",
"version": "17.15.3"
},
{
"status": "affected",
"version": "17.12.5b"
},
{
"status": "affected",
"version": "17.12.5c"
},
{
"status": "affected",
"version": "17.15.4"
},
{
"status": "affected",
"version": "17.18.1"
},
{
"status": "affected",
"version": "17.18.1a"
},
{
"status": "affected",
"version": "17.12.6"
},
{
"status": "affected",
"version": "17.15.4c"
},
{
"status": "affected",
"version": "17.12.5d"
},
{
"status": "affected",
"version": "17.18.2"
},
{
"status": "affected",
"version": "17.15.5"
},
{
"status": "affected",
"version": "17.15.5a"
},
{
"status": "affected",
"version": "17.12.7"
},
{
"status": "affected",
"version": "17.12.7a"
},
{
"status": "affected",
"version": "17.12.7b"
},
{
"status": "affected",
"version": "17.18.3a"
},
{
"status": "affected",
"version": "17.12.8"
},
{
"status": "affected",
"version": "17.15.6"
},
{
"status": "affected",
"version": "17.18.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.\r\n\r\nThe vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:11:11.783Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-snort3-gtpcodec-dos-Rmecfepz",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz"
}
],
"source": {
"advisory": "cisco-sa-snort3-gtpcodec-dos-Rmecfepz",
"defects": [
"CSCwu17795"
],
"discovery": "INTERNAL"
},
"title": "Multiple Cisco Products Snort 3 Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76445",
"datePublished": "2026-10-21T16:14:39.374Z",
"dateReserved": "2026-08-19T12:02:03.635Z",
"dateUpdated": "2026-10-22T19:11:11.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72712 (GCVE-0-2026-72712)
Vulnerability from cvelistv5 – Published: 2026-08-11 17:35 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet
Summary
Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:12 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nmap/nmap | product |
| https://github.com/nmap/nmap/issues/3368 | issue-tracking |
| https://github.com/nmap/nmap/commit/7ef4ee030a002… | patch |
| https://www.vulncheck.com/advisories/nmap-denial-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nmap Project | Nmap |
Affected:
0 , ≤ 7.99
(custom)
cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:* |
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72712",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:12:19.370583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:12:50.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nmap/nmap/issues/3368"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Nmap",
"vendor": "Nmap Project",
"versions": [
{
"lessThanOrEqual": "7.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Maxim Suhanov"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:55.660Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Product Repository",
"tags": [
"product"
],
"url": "https://github.com/nmap/nmap"
},
{
"name": "GitHub Issue",
"tags": [
"issue-tracking"
],
"url": "https://github.com/nmap/nmap/issues/3368"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp-option-packet"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72712",
"datePublished": "2026-08-11T17:35:06.192Z",
"dateReserved": "2026-08-10T13:02:52.001Z",
"dateUpdated": "2026-08-14T16:51:55.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71436 (GCVE-0-2026-71436)
Vulnerability from cvelistv5 – Published: 2026-08-06 19:49 – Updated: 2026-08-07 16:17
VLAI
EPSS
VEX
Title
Mermaid XY Charts are vulnerable to an infinite loop DoS
Summary
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 16:15 UTC
CWE
Assigner
GitHub_M
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/mermaid-js/mermaid/security/ad… | x_refsource_CONFIRM |
| https://github.com/mermaid-js/mermaid/pull/8022 | x_refsource_MISC |
| https://github.com/mermaid-js/mermaid/commit/630a… | x_refsource_MISC |
| https://github.com/mermaid-js/mermaid/commit/ef60… | x_refsource_MISC |
| https://github.com/mermaid-js/mermaid/releases/ta… | x_refsource_MISC |
| https://github.com/mermaid-js/mermaid/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mermaid-js | mermaid |
Affected:
>= 10.6.0, < 10.9.8
Affected: >= 11.0.0-alpha.1, < 11.16.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T16:15:22.877895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T16:17:15.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mermaid",
"vendor": "mermaid-js",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.0, \u003c 10.9.8"
},
{
"status": "affected",
"version": "\u003e= 11.0.0-alpha.1, \u003c 11.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325: Improperly Controlled Sequential Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T19:49:44.739Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7"
},
{
"name": "https://github.com/mermaid-js/mermaid/pull/8022",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mermaid-js/mermaid/pull/8022"
},
{
"name": "https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"
},
{
"name": "https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a"
},
{
"name": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1"
},
{
"name": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"
}
],
"source": {
"advisory": "GHSA-2v8p-3f2j-5mp7",
"discovery": "UNKNOWN"
},
"title": "Mermaid XY Charts are vulnerable to an infinite loop DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71436",
"datePublished": "2026-08-06T19:49:44.739Z",
"dateReserved": "2026-08-06T16:28:51.183Z",
"dateUpdated": "2026-08-07T16:17:15.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71227 (GCVE-0-2026-71227)
Vulnerability from cvelistv5 – Published: 2026-08-05 12:42 – Updated: 2026-11-02 05:13
VLAI
EPSS
VEX
Title
Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
Summary
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:10 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition
Assigner
redhat
CNA
References
8 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:56985 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67265 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67266 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67267 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:69285 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:87712 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-71227 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2462867 | issue-trackingx_refsource_REDHAT |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| Stephan Muelle | libkcapi |
Affected:
0.12.0 , < 1.5.1
(semver)
|
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.5.1-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:1.5.0-6.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:1.4.0-3.el8_10 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.4.0-3.el9_8 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:9::baseos |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:1.4.0-2.el9_6.1 , < *
(rpm)
cpe:/o:redhat:rhel_eus:9.6::baseos |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.5.1-0.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 5 |
cpe:/a:redhat:openshift:5
|
Date Public
2026-08-05 12:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:10:05.043014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:10:21.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libkcapi",
"repo": "https://github.com/smuellerDD/libkcapi",
"vendor": "Stephan Muelle",
"versions": [
{
"lessThan": "1.5.1",
"status": "affected",
"version": "0.12.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libkcapi",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.1-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libkcapi",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.0-6.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"defaultStatus": "affected",
"packageName": "libkcapi",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.4.0-3.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"defaultStatus": "affected",
"packageName": "libkcapi",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.4.0-3.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6::baseos"
],
"defaultStatus": "affected",
"packageName": "libkcapi",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.4.0-2.el9_6.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libkcapi-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.5.1-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:5"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 5",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
}
],
"datePublic": "2026-08-05T12:29:09.516Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T05:13:20.482Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:56985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56985"
},
{
"name": "RHSA-2026:67265",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67265"
},
{
"name": "RHSA-2026:67266",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67266"
},
{
"name": "RHSA-2026:67267",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67267"
},
{
"name": "RHSA-2026:69285",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:69285"
},
{
"name": "RHSA-2026:87712",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:87712"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-71227"
},
{
"name": "RHBZ#2462867",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462867"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-26T20:17:44.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-05T12:29:09.516Z",
"value": "Made public."
}
],
"title": "Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, applications should avoid initializing `libkcapi` handles with `KCAPI_INIT_AIO` if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize `libkcapi` handles after any AIO completion error, rather than reusing them for subsequent AIO operations."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-835: Loop with Unreachable Exit Condition"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-71227",
"datePublished": "2026-08-05T12:42:10.427Z",
"dateReserved": "2026-08-05T09:15:14.859Z",
"dateUpdated": "2026-11-02T05:13:20.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70462 (GCVE-0-2026-70462)
Vulnerability from cvelistv5 – Published: 2026-08-13 14:42 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
Summary
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:35 UTC
CWE
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/RsyncProject/rsync/security/ad… | vendor-advisory |
| https://github.com/RsyncProject/rsync/releases/ta… | release-notes |
| https://www.vulncheck.com/advisories/rsync-signed… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RsyncProject | rsync |
Affected:
3.1.0 , ≤ 3.4.4
(semver)
Unaffected: 3.5.0 (semver) cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* |
Date Public
2026-08-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:35:36.532126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:35:52.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/RsyncProject/rsync",
"product": "rsync",
"repo": "https://github.com/RsyncProject/rsync",
"vendor": "RsyncProject",
"versions": [
{
"lessThanOrEqual": "3.4.4",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.4.4",
"versionStartIncluding": "3.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "z3r0s6"
},
{
"lang": "en",
"type": "finder",
"value": "buger"
}
],
"datePublic": "2026-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ersync 3.1.0 before 3.5.0\u0026nbsp;contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.\u003c/p\u003e"
}
],
"value": "rsync 3.1.0 before 3.5.0\u00a0contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:24.927Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j9wh-5jmp-2m64)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64"
},
{
"name": "rsync 3.5.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "rsync 3.1.0 \u003c 3.5.0\u00a0Signed Integer Overflow via MSG_IO_TIMEOUT",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-70462",
"datePublished": "2026-08-13T14:42:28.449Z",
"dateReserved": "2026-08-04T14:52:23.815Z",
"dateUpdated": "2026-08-14T16:51:24.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69210 (GCVE-0-2026-69210)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:19 – Updated: 2026-09-17 16:45
VLAI
EPSS
VEX
Title
Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Summary
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:45 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/http4s/http4s/security/advisor… | x_refsource_CONFIRM |
| https://github.com/http4s/http4s/commit/c7d3ef90d… | x_refsource_MISC |
| https://github.com/http4s/http4s/releases/tag/v0.23.35 | x_refsource_MISC |
| https://github.com/http4s/http4s/releases/tag/v1.… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69210",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:45:07.781762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:45:18.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "http4s",
"vendor": "http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.35"
},
{
"status": "affected",
"version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M47"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284: Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:19:04.868Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/http4s/http4s/security/advisories/GHSA-3j86-pj9g-jchr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/http4s/http4s/security/advisories/GHSA-3j86-pj9g-jchr"
},
{
"name": "https://github.com/http4s/http4s/commit/c7d3ef90dc2ed1cd464968ab1b34f2f1762ddae2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/http4s/commit/c7d3ef90dc2ed1cd464968ab1b34f2f1762ddae2"
},
{
"name": "https://github.com/http4s/http4s/releases/tag/v0.23.35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/http4s/releases/tag/v0.23.35"
},
{
"name": "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"
}
],
"source": {
"advisory": "GHSA-3j86-pj9g-jchr",
"discovery": "UNKNOWN"
},
"title": "Http4s: WebSocket decoder accepts negative length, causing infinite decode loop"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69210",
"datePublished": "2026-09-15T19:19:04.868Z",
"dateReserved": "2026-08-03T16:57:50.124Z",
"dateUpdated": "2026-09-17T16:45:18.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68906 (GCVE-0-2026-68906)
Vulnerability from cvelistv5 – Published: 2026-10-16 15:49 – Updated: 2026-10-19 12:33
VLAI
EPSS
VEX
Title
libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
Summary
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 12:33 UTC
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mz-automation/libiec61850/secu… | x_refsource_CONFIRM |
| https://github.com/mz-automation/libiec61850/comm… | x_refsource_MISC |
| https://github.com/mz-automation/libiec61850/rele… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mz-automation | libiec61850 |
Affected:
< 1.6.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68906",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T12:33:28.090999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T12:33:42.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mz-automation/libiec61850/security/advisories/GHSA-f7xm-q62q-22cx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "libiec61850",
"vendor": "mz-automation",
"versions": [
{
"status": "affected",
"version": "\u003c 1.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:49:32.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mz-automation/libiec61850/security/advisories/GHSA-f7xm-q62q-22cx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mz-automation/libiec61850/security/advisories/GHSA-f7xm-q62q-22cx"
},
{
"name": "https://github.com/mz-automation/libiec61850/commit/2edf2a12bf0ced6a2ac595862e3e873814983f7f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mz-automation/libiec61850/commit/2edf2a12bf0ced6a2ac595862e3e873814983f7f"
},
{
"name": "https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2"
}
],
"source": {
"advisory": "GHSA-f7xm-q62q-22cx",
"discovery": "UNKNOWN"
},
"title": "libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-68906",
"datePublished": "2026-10-16T15:49:32.595Z",
"dateReserved": "2026-07-31T21:04:04.040Z",
"dateUpdated": "2026-10-19T12:33:42.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.