In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in...

CVE-2026-118035

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient al

历史摘要 · 未重新核验 · NVD

Go JOSE: DoS when parsing JWKs that contain RSA keys

CVE-2026-116587

### Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. ### Details go

历史摘要 · 未重新核验 · GitHub Advisory

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unaut...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedl

历史摘要 · 未重新核验 · NVD

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to caus...

CVE-2026-116872

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_com

来源摘录 · NVD

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (J...

CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including sup

历史摘要 · 未重新核验 · NVD

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accept

来源摘录 · NVD

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key....

CVE-2026-65631

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion de

历史摘要 · 未重新核验 · NVD

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

CVE-2026-115585

### Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-re

历史摘要 · 未重新核验 · GitHub Advisory

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could s...

CVE-2026-115585

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malform

来源摘录 · NVD

pypdf: Possible long runtimes/large memory usage when retrieving form fields

CVE-2026-113789

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtim

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

CVE-2026-114141

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

CVE-2026-114143

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted ke

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

CVE-2026-75507

### Summary The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and in the worst case `O(

历史摘要 · 未重新核验 · GitHub Advisory

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server thro...

CVE-2026-115319

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows

来源摘录 · NVD

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif he...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the rema

历史摘要 · 未重新核验 · NVD

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplica...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py tre

历史摘要 · 未重新核验 · NVD

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dot...

CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every

历史摘要 · 未重新核验 · NVD

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPath...

CVE-2026-114141

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func

历史摘要 · 未重新核验 · NVD

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in

来源摘录 · NVD