Common Weakness Enumeration
CWE-606
AllowedUnchecked Input for Loop Condition
Abstraction: Base · Status: Draft
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
79 vulnerabilities reference this CWE, most recent first.
CVE-2026-33800 (GCVE-0-2026-33800)
Vulnerability from cvelistv5 – Published: 2026-07-09 21:03 – Updated: 2026-07-20 13:05
VLAI
EPSS
VEX
Title
Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash
Summary
An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing. Especially in a Virtual-Chassis (VC) scenario with locality‑bias configured, processing takes a significant amount of time for each event. If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events. This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.
This issue only affects MX series FPCs up to and including MPC9, and LC2101/2103 and LC480. It does not affect MPC10/11, LC4800/9600, and MX304.
This issue affects Junos OS on MX Series:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S8,
* 24.2 versions before 24.2R2-S4,
* 24.4 versions before 24.4R2-S3,
* 25.2 versions before 25.2R2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 13:31 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.juniper.net/JSA110075 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Juniper Networks | Junos OS |
Affected:
0 , < 23.2R2-S7
(custom)
Affected: 23.4 , < 23.4R2-S8 (custom) Affected: 24.2 , < 24.2R2-S4 (custom) Affected: 24.4 , < 24.4R2-S3 (custom) Affected: 25.2 , < 25.2R2 (custom) |
Date Public
2026-07-08 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T13:31:18.681766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T13:31:28.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MX Series"
],
"product": "Junos OS",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "23.2R2-S7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "23.4R2-S8",
"status": "affected",
"version": "23.4",
"versionType": "custom"
},
{
"lessThan": "24.2R2-S4",
"status": "affected",
"version": "24.2",
"versionType": "custom"
},
{
"lessThan": "24.4R2-S3",
"status": "affected",
"version": "24.4",
"versionType": "custom"
},
{
"lessThan": "25.2R2",
"status": "affected",
"version": "25.2",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "To be exposed to this issue an MX VC needs to be configured with locality bias as follows:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[ virtual-chassis locality-bias ]\u003c/tt\u003e"
}
],
"value": "To be exposed to this issue an MX VC needs to be configured with locality bias as follows:\n\n[ virtual-chassis locality-bias ]"
}
],
"datePublic": "2026-07-08T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMicro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing. Especially in a \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVirtual-Chassis (VC) scenario with\u0026nbsp;locality\u2011bias configured,\u0026nbsp;\u003c/span\u003eprocessing takes a significant amount of time for each event.\u0026nbsp;If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events. This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue only affects MX series FPCs up to and including MPC9, and\u0026nbsp;LC2101/2103 and LC480.\u0026nbsp;It does not affect MPC10/11, LC4800/9600, and MX304.\u003c/p\u003e\u003cp\u003eThis issue affects Junos OS on MX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eall versions before 23.2R2-S7,\u003c/li\u003e\u003cli\u003e23.4 versions before 23.4R2-S8,\u003c/li\u003e\u003cli\u003e24.2 versions before 24.2R2-S4,\u003c/li\u003e\u003cli\u003e24.4 versions before 24.4R2-S3,\u003c/li\u003e\u003cli\u003e25.2 versions before 25.2R2.\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing. Especially in a Virtual-Chassis (VC) scenario with\u00a0locality\u2011bias configured,\u00a0processing takes a significant amount of time for each event.\u00a0If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events. This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.\n\n\nThis issue only affects MX series FPCs up to and including MPC9, and\u00a0LC2101/2103 and LC480.\u00a0It does not affect MPC10/11, LC4800/9600, and MX304.\n\nThis issue affects Junos OS on MX Series:\n\n\n * all versions before 23.2R2-S7,\n * 23.4 versions before 23.4R2-S8,\n * 24.2 versions before 24.2R2-S4,\n * 24.4 versions before 24.4R2-S3,\n * 25.2 versions before 25.2R2."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606 Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:05:07.325Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.juniper.net/JSA110075"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1, and all subsequent releases."
}
],
"value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 23.2R2-S7, 23.4R2-S8, 24.2R2-S4, 24.4R2-S3, 25.2R2, 25.4R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA110075",
"defect": [
"1902535"
],
"discovery": "USER"
},
"title": "Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "To reduce the risk of exploitation, configure BFD with an increased holddown-timer, so that the queued events can be processed before a new up event occurs:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[ ... bfd-liveness-detection\u0026nbsp;holddown-interval milliseconds \u0026lt;value\u0026gt; ]\u003c/tt\u003e\u003cbr\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "To reduce the risk of exploitation, configure BFD with an increased holddown-timer, so that the queued events can be processed before a new up event occurs:\n\n[ ... bfd-liveness-detection\u00a0holddown-interval milliseconds \u003cvalue\u003e ]"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2026-33800",
"datePublished": "2026-07-09T21:03:00.614Z",
"dateReserved": "2026-03-23T19:46:13.673Z",
"dateUpdated": "2026-07-20T13:05:07.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27689 (GCVE-0-2026-27689)
Vulnerability from cvelistv5 – Published: 2026-03-10 00:19 – Updated: 2026-03-10 16:52
VLAI
EPSS
VEX
Title
Denial of service (DOS) in SAP Supply Chain Management
Summary
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 15:35 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP_SE | SAP Supply Chain Management |
Affected:
SCMAPO 713
Affected: 714 Affected: S4CORE 102 Affected: 103 Affected: 104 Affected: S4COREOP 105 Affected: 106 Affected: 107 Affected: 108 Affected: 109 Affected: SCM 700 Affected: 701 Affected: 702 Affected: 712 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T15:35:53.163951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T16:52:30.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP Supply Chain Management",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "SCMAPO 713"
},
{
"status": "affected",
"version": "714"
},
{
"status": "affected",
"version": "S4CORE 102"
},
{
"status": "affected",
"version": "103"
},
{
"status": "affected",
"version": "104"
},
{
"status": "affected",
"version": "S4COREOP 105"
},
{
"status": "affected",
"version": "106"
},
{
"status": "affected",
"version": "107"
},
{
"status": "affected",
"version": "108"
},
{
"status": "affected",
"version": "109"
},
{
"status": "affected",
"version": "SCM 700"
},
{
"status": "affected",
"version": "701"
},
{
"status": "affected",
"version": "702"
},
{
"status": "affected",
"version": "712"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDue to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.\u003c/p\u003e"
}
],
"value": "Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T00:19:05.551Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3719502"
},
{
"url": "https://url.sap/sapsecuritypatchday"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of service (DOS) in SAP Supply Chain Management",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2026-27689",
"datePublished": "2026-03-10T00:19:05.551Z",
"dateReserved": "2026-02-23T17:50:17.028Z",
"dateUpdated": "2026-03-10T16:52:30.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23689 (GCVE-0-2026-23689)
Vulnerability from cvelistv5 – Published: 2026-02-10 03:03 – Updated: 2026-02-27 14:27
VLAI
EPSS
VEX
Title
Denial of service (DOS) in SAP Supply Chain Management
Summary
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 17:18 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SAP_SE | SAP Supply Chain Management |
Affected:
SCMAPO 713
Affected: 714 Affected: SCM 700 Affected: 701 Affected: 702 Affected: 712 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-10T17:18:05.323367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T14:27:50.545Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP Supply Chain Management",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "SCMAPO 713"
},
{
"status": "affected",
"version": "714"
},
{
"status": "affected",
"version": "SCM 700"
},
{
"status": "affected",
"version": "701"
},
{
"status": "affected",
"version": "702"
},
{
"status": "affected",
"version": "712"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDue to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.\u003c/p\u003e"
}
],
"value": "Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T03:03:09.536Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3703092"
},
{
"url": "https://url.sap/sapsecuritypatchday"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of service (DOS) in SAP Supply Chain Management",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2026-23689",
"datePublished": "2026-02-10T03:03:09.536Z",
"dateReserved": "2026-01-14T18:26:17.297Z",
"dateUpdated": "2026-02-27T14:27:50.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20301 (GCVE-0-2026-20301)
Vulnerability from cvelistv5 – Published: 2026-08-05 16:28 – Updated: 2026-08-05 17:45
VLAI
EPSS
VEX
Title
Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
Summary
A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 17:35 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IOS XE Software |
Affected:
17.2.1a
Affected: 16.12.1y Affected: 16.12.3s Affected: 16.7.1b Affected: 16.6.2 Affected: 16.6.5 Affected: 16.12.1w Affected: 16.9.1d Affected: 17.3.1 Affected: 16.9.4c Affected: 16.7.1 Affected: 17.2.1 Affected: 16.6.8 Affected: 16.9.1b Affected: 16.9.2s Affected: 16.12.4 Affected: 16.12.3a Affected: 17.1.1s Affected: 16.11.1a Affected: 16.7.2 Affected: 16.11.1b Affected: 16.9.1s Affected: 16.9.3h Affected: 16.9.1c Affected: 16.6.5a Affected: 16.6.3 Affected: 16.10.1f Affected: 17.2.1v Affected: 16.8.1e Affected: 16.9.3a Affected: 16.12.1a Affected: 16.12.1x Affected: 3.16.10aS Affected: 16.6.4s Affected: 16.10.1c Affected: 16.12.3 Affected: 16.11.2 Affected: 16.6.5b Affected: 16.12.2s Affected: 16.10.1b Affected: 16.7.3 Affected: 16.6.7 Affected: 16.9.6 Affected: 16.9.2 Affected: 16.10.1 Affected: 16.12.1t Affected: 16.9.1 Affected: 16.8.1a Affected: 3.18.8aSP Affected: 16.9.3s Affected: 16.6.7a Affected: 16.12.2 Affected: 16.11.1 Affected: 16.9.3 Affected: 16.11.1s Affected: 16.12.1 Affected: 17.1.1 Affected: 17.1.2 Affected: 16.10.1d Affected: 17.1.1t Affected: 16.9.4 Affected: 16.8.3 Affected: 16.12.2t Affected: 16.9.5 Affected: 16.8.1s Affected: 16.10.1e Affected: 16.8.2 Affected: 16.6.4 Affected: 16.8.1b Affected: 16.10.1a Affected: 16.12.1z Affected: 16.8.1c Affected: 16.9.1a Affected: 16.9.5f Affected: 16.6.4a Affected: 16.10.1g Affected: 16.8.1 Affected: 16.6.6 Affected: 16.9.2a Affected: 16.8.1d Affected: 16.10.3 Affected: 16.7.1a Affected: 16.11.1c Affected: 16.10.1s Affected: 17.2.1r Affected: 17.1.1a Affected: 16.10.2 Affected: 16.12.2a Affected: 16.12.1c Affected: 16.12.1s Affected: 16.7.4 Affected: 3.18.9SP Affected: 17.2.2 Affected: 3.11.3E Affected: 16.9.8 Affected: 16.9.7 Affected: 17.1.3 Affected: 17.3.1a Affected: 3.11.4E Affected: 17.3.2a Affected: 16.12.5 Affected: 17.3.1w Affected: 17.3.2 Affected: 3.11.3aE Affected: 17.4.1 Affected: 16.12.4a Affected: 17.4.1a Affected: 3.16.10bS Affected: 17.3.1x Affected: 17.3.3 Affected: 16.6.9 Affected: 17.2.3 Affected: 17.5.1 Affected: 16.12.1z1 Affected: 16.12.5a Affected: 17.4.1b Affected: 17.3.1z Affected: 16.12.5b Affected: 17.4.2 Affected: 17.3.3a Affected: 3.11.5E Affected: 17.3.5 Affected: 17.3.4 Affected: 17.5.1a Affected: 16.12.6 Affected: 17.6.1 Affected: 16.12.1z2 Affected: 16.6.10 Affected: 17.3.4a Affected: 17.6.1a Affected: 3.8.10cE Affected: 17.7.1 Affected: 17.6.1x Affected: 17.6.2 Affected: 16.12.6a Affected: 17.3.4c Affected: 17.4.2a Affected: 17.3.4b Affected: 17.7.1a Affected: 16.12.7 Affected: 17.8.1a Affected: 17.6.3a Affected: 17.6.3 Affected: 17.7.2 Affected: 17.7.1b Affected: 17.9.1w Affected: 17.3.5a Affected: 17.6.1z Affected: 3.8.10dE Affected: 16.12.8 Affected: 17.8.1 Affected: 17.9.1 Affected: 3.11.6E Affected: 17.6.4 Affected: 3.11.7E Affected: 17.3.5b Affected: 17.9.1a Affected: 17.3.6 Affected: 17.10.1 Affected: 3.11.8E Affected: 16.9.8a Affected: 17.6.1z1 Affected: 17.10.1a Affected: 17.9.2 Affected: 17.6.5 Affected: 17.9.1x Affected: 17.9.1y Affected: 16.9.8b Affected: 17.3.7 Affected: 17.9.2a Affected: 17.9.3 Affected: 16.12.9 Affected: 17.11.1 Affected: 17.10.1b Affected: 17.6.6 Affected: 17.9.1x1 Affected: 17.11.1a Affected: 17.9.3a Affected: 17.12.1 Affected: 17.3.8 Affected: 17.9.4 Affected: 16.12.10 Affected: 17.12.1w Affected: 17.9.1y1 Affected: 17.12.1a Affected: 3.11.9E Affected: 17.9.5 Affected: 17.13.1 Affected: 17.12.1x Affected: 17.12.2 Affected: 17.14.1 Affected: 17.9.4a Affected: 17.3.8a Affected: 17.6.6a Affected: 17.6.5a Affected: 17.6.7 Affected: 16.12.10a Affected: 17.15.1 Affected: 17.13.1a Affected: 17.12.2a Affected: 16.12.11 Affected: 17.12.3 Affected: 17.12.1y Affected: 3.11.10E Affected: 17.12.1z Affected: 17.9.5a Affected: 17.14.1a Affected: 17.9.5b Affected: 17.6.8 Affected: 16.12.12 Affected: 17.12.4 Affected: 17.9.6 Affected: 17.17.1 Affected: 17.16.1 Affected: 17.15.1w Affected: 17.12.3a Affected: 3.11.11E Affected: 17.9.5c Affected: 17.15.1a Affected: 17.12.1z1 Affected: 17.15.2 Affected: 17.15.1b Affected: 17.9.5d Affected: 17.15.1x Affected: 17.9.6a Affected: 17.12.1z2 Affected: 17.6.8a Affected: 17.16.1a Affected: 16.12.13 Affected: 17.15.3 Affected: 17.9.7 Affected: 17.12.5 Affected: 17.15.1y Affected: 17.9.5e Affected: 17.12.4a Affected: 17.15.2a Affected: 17.15.2c Affected: 17.15.2b Affected: 17.12.1z3 Affected: 17.9.5f Affected: 17.12.4b Affected: 3.11.12E Affected: 17.12.5a Affected: 17.18.1 Affected: 17.12.6 Affected: 17.12.1z4 Affected: 17.9.8 Affected: 17.9.7a Affected: 17.15.3a Affected: 17.15.4 Affected: 3.11.13E Affected: 17.12.5b Affected: 17.15.3b Affected: 16.12.14 Affected: 17.18.1z Affected: 17.9.7b Affected: 17.12.5c Affected: 26.1.1 Affected: 17.18.1a Affected: 17.15.4a Affected: 17.18.2 Affected: 17.18.1w Affected: 17.15.4b Affected: 17.12.6a Affected: 17.12.7 Affected: 17.15.4c Affected: 17.9.9 Affected: 17.12.5d Affected: 16.12.15 Affected: 17.15.4s1 Affected: 17.15.5 Affected: 17.12.1z5 Affected: 17.18.1x Affected: 17.12.1z6 Affected: 17.15.4d Affected: 17.12.6b Affected: 17.4.1c Affected: 3.11.14E Affected: 17.15.5a Affected: 17.18.1y Affected: 17.12.7a Affected: 17.18.3 Affected: 17.12.7b Affected: 17.18.3a Affected: 26.1.1a Affected: 26.2.1ea Affected: 16.12.16 |
|
| Cisco | IOS |
Affected:
15.2(7)E7
Affected: 15.2(8)E3 Affected: 15.7(3)M10 Affected: 15.8(3)M9 Affected: 15.9(3)M7 Affected: 15.2(7)E8 Affected: 15.2(8)E4 Affected: 15.9(3)M7a Affected: 15.2(2)E10c Affected: 15.2(4)E10d Affected: 15.9(3)M6a Affected: 15.9(3)M6b Affected: 15.5(1)SY10 Affected: 15.5(1)SY11 Affected: 15.2(6)E1a Affected: 15.4(1)SY4 Affected: 15.5(1)SY1 Affected: 15.2(2)E8 Affected: 15.2(6)E1 Affected: 15.7(3)M2 Affected: 15.2(4)E6 Affected: 15.2(1)SY6 Affected: 15.2(4)EA7 Affected: 15.2(6)E1s Affected: 15.7(3)M3 Affected: 15.8(3)M Affected: 15.2(1)SY7 Affected: 15.2(4)EA8 Affected: 15.8(3)M0a Affected: 15.2(2)E9 Affected: 15.2(6)E2 Affected: 15.5(1)SY2 Affected: 15.2(4)E7 Affected: 15.2(6)E2a Affected: 15.2(2)E9a Affected: 15.8(3)M0b Affected: 15.2(6)E2b Affected: 15.8(3)M1 Affected: 15.8(3)M1a Affected: 15.7(3)M4 Affected: 15.2(1)SY8 Affected: 15.2(4)E8 Affected: 15.5(1)SY3 Affected: 15.2(7)E Affected: 15.7(3)M4a Affected: 15.8(3)M2 Affected: 15.2(7)E0a Affected: 15.8(3)M2a Affected: 15.7(3)M4b Affected: 15.2(2)E10 Affected: 15.2(7)E0s Affected: 15.2(4)EA9 Affected: 15.2(7)E0b Affected: 15.2(6)E3 Affected: 15.9(3)M Affected: 15.8(3)M3 Affected: 15.5(1)SY4 Affected: 15.7(3)M5 Affected: 15.2(2)E10a Affected: 15.2(4)E9 Affected: 15.2(7)E1 Affected: 15.8(3)M3b Affected: 15.9(3)M0a Affected: 15.2(7)E1a Affected: 15.2(4)E10 Affected: 15.5(1)SY5 Affected: 15.2(4)EA9a Affected: 15.9(3)M1 Affected: 15.8(3)M4 Affected: 15.7(3)M6 Affected: 15.2(7)E2 Affected: 15.5(1)SY6 Affected: 15.2(7)E3 Affected: 15.8(3)M5 Affected: 15.7(3)M7 Affected: 15.9(3)M2 Affected: 15.2(7)E2b Affected: 15.9(3)M2a Affected: 15.2(4)E10a Affected: 15.2(7)E4 Affected: 15.5(1)SY7 Affected: 15.2(4)E10b Affected: 15.2(7)E3k Affected: 15.2(8)E Affected: 15.9(3)M3 Affected: 15.8(3)M6 Affected: 15.7(3)M8 Affected: 15.8(3)M7 Affected: 15.5(1)SY8 Affected: 15.2(7)E5 Affected: 15.2(8)E1 Affected: 15.9(3)M4 Affected: 15.2(8)E2 Affected: 15.2(4)E10c Affected: 15.7(3)M9 Affected: 15.2(2)E10b Affected: 15.2(7)E6 Affected: 15.9(3)M4a Affected: 15.5(1)SY9 Affected: 15.9(3)M5 Affected: 15.8(3)M8 Affected: 15.9(3)M6 Affected: 15.9(3)M9 Affected: 15.5(1)SY13 Affected: 15.9(3)M8b Affected: 15.2(7)E9 Affected: 15.5(1)SY12 Affected: 15.7(3)M10a Affected: 15.9(3)M8 Affected: 15.9(3)M8a Affected: 15.2(8)E5 Affected: 15.2(7)E10 Affected: 15.7(3)M10b Affected: 15.9(3)M3a Affected: 15.8(3)M3a Affected: 15.9(3)M3b Affected: 15.6(2)SP7 Affected: 15.6(2)SP5 Affected: 15.6(2)SP8 Affected: 15.6(2)SP6 Affected: 15.6(2)SP4 Affected: 15.6(2)SP9 Affected: 15.6(2)SP8a Affected: 15.9(3)M9a Affected: 15.2(8)E6 Affected: 15.9(3)M10 Affected: 15.2(7)E11 Affected: 15.5(1)SY14 Affected: 15.2(8)E7 Affected: 15.2(4)E10e Affected: 15.9(3)M11 Affected: 15.2(7)E12 Affected: 15.5(1)SY15 Affected: 15.2(8)E8 Affected: 15.5(1)SY16 Affected: 15.2(7)E13 Affected: 15.9(3)M12 Affected: 15.5(1)SY17 Affected: 15.2(7)E14 Affected: 15.9(3)M13 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20301",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:35:10.643585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:45:13.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco IOS XE Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "17.2.1a"
},
{
"status": "affected",
"version": "16.12.1y"
},
{
"status": "affected",
"version": "16.12.3s"
},
{
"status": "affected",
"version": "16.7.1b"
},
{
"status": "affected",
"version": "16.6.2"
},
{
"status": "affected",
"version": "16.6.5"
},
{
"status": "affected",
"version": "16.12.1w"
},
{
"status": "affected",
"version": "16.9.1d"
},
{
"status": "affected",
"version": "17.3.1"
},
{
"status": "affected",
"version": "16.9.4c"
},
{
"status": "affected",
"version": "16.7.1"
},
{
"status": "affected",
"version": "17.2.1"
},
{
"status": "affected",
"version": "16.6.8"
},
{
"status": "affected",
"version": "16.9.1b"
},
{
"status": "affected",
"version": "16.9.2s"
},
{
"status": "affected",
"version": "16.12.4"
},
{
"status": "affected",
"version": "16.12.3a"
},
{
"status": "affected",
"version": "17.1.1s"
},
{
"status": "affected",
"version": "16.11.1a"
},
{
"status": "affected",
"version": "16.7.2"
},
{
"status": "affected",
"version": "16.11.1b"
},
{
"status": "affected",
"version": "16.9.1s"
},
{
"status": "affected",
"version": "16.9.3h"
},
{
"status": "affected",
"version": "16.9.1c"
},
{
"status": "affected",
"version": "16.6.5a"
},
{
"status": "affected",
"version": "16.6.3"
},
{
"status": "affected",
"version": "16.10.1f"
},
{
"status": "affected",
"version": "17.2.1v"
},
{
"status": "affected",
"version": "16.8.1e"
},
{
"status": "affected",
"version": "16.9.3a"
},
{
"status": "affected",
"version": "16.12.1a"
},
{
"status": "affected",
"version": "16.12.1x"
},
{
"status": "affected",
"version": "3.16.10aS"
},
{
"status": "affected",
"version": "16.6.4s"
},
{
"status": "affected",
"version": "16.10.1c"
},
{
"status": "affected",
"version": "16.12.3"
},
{
"status": "affected",
"version": "16.11.2"
},
{
"status": "affected",
"version": "16.6.5b"
},
{
"status": "affected",
"version": "16.12.2s"
},
{
"status": "affected",
"version": "16.10.1b"
},
{
"status": "affected",
"version": "16.7.3"
},
{
"status": "affected",
"version": "16.6.7"
},
{
"status": "affected",
"version": "16.9.6"
},
{
"status": "affected",
"version": "16.9.2"
},
{
"status": "affected",
"version": "16.10.1"
},
{
"status": "affected",
"version": "16.12.1t"
},
{
"status": "affected",
"version": "16.9.1"
},
{
"status": "affected",
"version": "16.8.1a"
},
{
"status": "affected",
"version": "3.18.8aSP"
},
{
"status": "affected",
"version": "16.9.3s"
},
{
"status": "affected",
"version": "16.6.7a"
},
{
"status": "affected",
"version": "16.12.2"
},
{
"status": "affected",
"version": "16.11.1"
},
{
"status": "affected",
"version": "16.9.3"
},
{
"status": "affected",
"version": "16.11.1s"
},
{
"status": "affected",
"version": "16.12.1"
},
{
"status": "affected",
"version": "17.1.1"
},
{
"status": "affected",
"version": "17.1.2"
},
{
"status": "affected",
"version": "16.10.1d"
},
{
"status": "affected",
"version": "17.1.1t"
},
{
"status": "affected",
"version": "16.9.4"
},
{
"status": "affected",
"version": "16.8.3"
},
{
"status": "affected",
"version": "16.12.2t"
},
{
"status": "affected",
"version": "16.9.5"
},
{
"status": "affected",
"version": "16.8.1s"
},
{
"status": "affected",
"version": "16.10.1e"
},
{
"status": "affected",
"version": "16.8.2"
},
{
"status": "affected",
"version": "16.6.4"
},
{
"status": "affected",
"version": "16.8.1b"
},
{
"status": "affected",
"version": "16.10.1a"
},
{
"status": "affected",
"version": "16.12.1z"
},
{
"status": "affected",
"version": "16.8.1c"
},
{
"status": "affected",
"version": "16.9.1a"
},
{
"status": "affected",
"version": "16.9.5f"
},
{
"status": "affected",
"version": "16.6.4a"
},
{
"status": "affected",
"version": "16.10.1g"
},
{
"status": "affected",
"version": "16.8.1"
},
{
"status": "affected",
"version": "16.6.6"
},
{
"status": "affected",
"version": "16.9.2a"
},
{
"status": "affected",
"version": "16.8.1d"
},
{
"status": "affected",
"version": "16.10.3"
},
{
"status": "affected",
"version": "16.7.1a"
},
{
"status": "affected",
"version": "16.11.1c"
},
{
"status": "affected",
"version": "16.10.1s"
},
{
"status": "affected",
"version": "17.2.1r"
},
{
"status": "affected",
"version": "17.1.1a"
},
{
"status": "affected",
"version": "16.10.2"
},
{
"status": "affected",
"version": "16.12.2a"
},
{
"status": "affected",
"version": "16.12.1c"
},
{
"status": "affected",
"version": "16.12.1s"
},
{
"status": "affected",
"version": "16.7.4"
},
{
"status": "affected",
"version": "3.18.9SP"
},
{
"status": "affected",
"version": "17.2.2"
},
{
"status": "affected",
"version": "3.11.3E"
},
{
"status": "affected",
"version": "16.9.8"
},
{
"status": "affected",
"version": "16.9.7"
},
{
"status": "affected",
"version": "17.1.3"
},
{
"status": "affected",
"version": "17.3.1a"
},
{
"status": "affected",
"version": "3.11.4E"
},
{
"status": "affected",
"version": "17.3.2a"
},
{
"status": "affected",
"version": "16.12.5"
},
{
"status": "affected",
"version": "17.3.1w"
},
{
"status": "affected",
"version": "17.3.2"
},
{
"status": "affected",
"version": "3.11.3aE"
},
{
"status": "affected",
"version": "17.4.1"
},
{
"status": "affected",
"version": "16.12.4a"
},
{
"status": "affected",
"version": "17.4.1a"
},
{
"status": "affected",
"version": "3.16.10bS"
},
{
"status": "affected",
"version": "17.3.1x"
},
{
"status": "affected",
"version": "17.3.3"
},
{
"status": "affected",
"version": "16.6.9"
},
{
"status": "affected",
"version": "17.2.3"
},
{
"status": "affected",
"version": "17.5.1"
},
{
"status": "affected",
"version": "16.12.1z1"
},
{
"status": "affected",
"version": "16.12.5a"
},
{
"status": "affected",
"version": "17.4.1b"
},
{
"status": "affected",
"version": "17.3.1z"
},
{
"status": "affected",
"version": "16.12.5b"
},
{
"status": "affected",
"version": "17.4.2"
},
{
"status": "affected",
"version": "17.3.3a"
},
{
"status": "affected",
"version": "3.11.5E"
},
{
"status": "affected",
"version": "17.3.5"
},
{
"status": "affected",
"version": "17.3.4"
},
{
"status": "affected",
"version": "17.5.1a"
},
{
"status": "affected",
"version": "16.12.6"
},
{
"status": "affected",
"version": "17.6.1"
},
{
"status": "affected",
"version": "16.12.1z2"
},
{
"status": "affected",
"version": "16.6.10"
},
{
"status": "affected",
"version": "17.3.4a"
},
{
"status": "affected",
"version": "17.6.1a"
},
{
"status": "affected",
"version": "3.8.10cE"
},
{
"status": "affected",
"version": "17.7.1"
},
{
"status": "affected",
"version": "17.6.1x"
},
{
"status": "affected",
"version": "17.6.2"
},
{
"status": "affected",
"version": "16.12.6a"
},
{
"status": "affected",
"version": "17.3.4c"
},
{
"status": "affected",
"version": "17.4.2a"
},
{
"status": "affected",
"version": "17.3.4b"
},
{
"status": "affected",
"version": "17.7.1a"
},
{
"status": "affected",
"version": "16.12.7"
},
{
"status": "affected",
"version": "17.8.1a"
},
{
"status": "affected",
"version": "17.6.3a"
},
{
"status": "affected",
"version": "17.6.3"
},
{
"status": "affected",
"version": "17.7.2"
},
{
"status": "affected",
"version": "17.7.1b"
},
{
"status": "affected",
"version": "17.9.1w"
},
{
"status": "affected",
"version": "17.3.5a"
},
{
"status": "affected",
"version": "17.6.1z"
},
{
"status": "affected",
"version": "3.8.10dE"
},
{
"status": "affected",
"version": "16.12.8"
},
{
"status": "affected",
"version": "17.8.1"
},
{
"status": "affected",
"version": "17.9.1"
},
{
"status": "affected",
"version": "3.11.6E"
},
{
"status": "affected",
"version": "17.6.4"
},
{
"status": "affected",
"version": "3.11.7E"
},
{
"status": "affected",
"version": "17.3.5b"
},
{
"status": "affected",
"version": "17.9.1a"
},
{
"status": "affected",
"version": "17.3.6"
},
{
"status": "affected",
"version": "17.10.1"
},
{
"status": "affected",
"version": "3.11.8E"
},
{
"status": "affected",
"version": "16.9.8a"
},
{
"status": "affected",
"version": "17.6.1z1"
},
{
"status": "affected",
"version": "17.10.1a"
},
{
"status": "affected",
"version": "17.9.2"
},
{
"status": "affected",
"version": "17.6.5"
},
{
"status": "affected",
"version": "17.9.1x"
},
{
"status": "affected",
"version": "17.9.1y"
},
{
"status": "affected",
"version": "16.9.8b"
},
{
"status": "affected",
"version": "17.3.7"
},
{
"status": "affected",
"version": "17.9.2a"
},
{
"status": "affected",
"version": "17.9.3"
},
{
"status": "affected",
"version": "16.12.9"
},
{
"status": "affected",
"version": "17.11.1"
},
{
"status": "affected",
"version": "17.10.1b"
},
{
"status": "affected",
"version": "17.6.6"
},
{
"status": "affected",
"version": "17.9.1x1"
},
{
"status": "affected",
"version": "17.11.1a"
},
{
"status": "affected",
"version": "17.9.3a"
},
{
"status": "affected",
"version": "17.12.1"
},
{
"status": "affected",
"version": "17.3.8"
},
{
"status": "affected",
"version": "17.9.4"
},
{
"status": "affected",
"version": "16.12.10"
},
{
"status": "affected",
"version": "17.12.1w"
},
{
"status": "affected",
"version": "17.9.1y1"
},
{
"status": "affected",
"version": "17.12.1a"
},
{
"status": "affected",
"version": "3.11.9E"
},
{
"status": "affected",
"version": "17.9.5"
},
{
"status": "affected",
"version": "17.13.1"
},
{
"status": "affected",
"version": "17.12.1x"
},
{
"status": "affected",
"version": "17.12.2"
},
{
"status": "affected",
"version": "17.14.1"
},
{
"status": "affected",
"version": "17.9.4a"
},
{
"status": "affected",
"version": "17.3.8a"
},
{
"status": "affected",
"version": "17.6.6a"
},
{
"status": "affected",
"version": "17.6.5a"
},
{
"status": "affected",
"version": "17.6.7"
},
{
"status": "affected",
"version": "16.12.10a"
},
{
"status": "affected",
"version": "17.15.1"
},
{
"status": "affected",
"version": "17.13.1a"
},
{
"status": "affected",
"version": "17.12.2a"
},
{
"status": "affected",
"version": "16.12.11"
},
{
"status": "affected",
"version": "17.12.3"
},
{
"status": "affected",
"version": "17.12.1y"
},
{
"status": "affected",
"version": "3.11.10E"
},
{
"status": "affected",
"version": "17.12.1z"
},
{
"status": "affected",
"version": "17.9.5a"
},
{
"status": "affected",
"version": "17.14.1a"
},
{
"status": "affected",
"version": "17.9.5b"
},
{
"status": "affected",
"version": "17.6.8"
},
{
"status": "affected",
"version": "16.12.12"
},
{
"status": "affected",
"version": "17.12.4"
},
{
"status": "affected",
"version": "17.9.6"
},
{
"status": "affected",
"version": "17.17.1"
},
{
"status": "affected",
"version": "17.16.1"
},
{
"status": "affected",
"version": "17.15.1w"
},
{
"status": "affected",
"version": "17.12.3a"
},
{
"status": "affected",
"version": "3.11.11E"
},
{
"status": "affected",
"version": "17.9.5c"
},
{
"status": "affected",
"version": "17.15.1a"
},
{
"status": "affected",
"version": "17.12.1z1"
},
{
"status": "affected",
"version": "17.15.2"
},
{
"status": "affected",
"version": "17.15.1b"
},
{
"status": "affected",
"version": "17.9.5d"
},
{
"status": "affected",
"version": "17.15.1x"
},
{
"status": "affected",
"version": "17.9.6a"
},
{
"status": "affected",
"version": "17.12.1z2"
},
{
"status": "affected",
"version": "17.6.8a"
},
{
"status": "affected",
"version": "17.16.1a"
},
{
"status": "affected",
"version": "16.12.13"
},
{
"status": "affected",
"version": "17.15.3"
},
{
"status": "affected",
"version": "17.9.7"
},
{
"status": "affected",
"version": "17.12.5"
},
{
"status": "affected",
"version": "17.15.1y"
},
{
"status": "affected",
"version": "17.9.5e"
},
{
"status": "affected",
"version": "17.12.4a"
},
{
"status": "affected",
"version": "17.15.2a"
},
{
"status": "affected",
"version": "17.15.2c"
},
{
"status": "affected",
"version": "17.15.2b"
},
{
"status": "affected",
"version": "17.12.1z3"
},
{
"status": "affected",
"version": "17.9.5f"
},
{
"status": "affected",
"version": "17.12.4b"
},
{
"status": "affected",
"version": "3.11.12E"
},
{
"status": "affected",
"version": "17.12.5a"
},
{
"status": "affected",
"version": "17.18.1"
},
{
"status": "affected",
"version": "17.12.6"
},
{
"status": "affected",
"version": "17.12.1z4"
},
{
"status": "affected",
"version": "17.9.8"
},
{
"status": "affected",
"version": "17.9.7a"
},
{
"status": "affected",
"version": "17.15.3a"
},
{
"status": "affected",
"version": "17.15.4"
},
{
"status": "affected",
"version": "3.11.13E"
},
{
"status": "affected",
"version": "17.12.5b"
},
{
"status": "affected",
"version": "17.15.3b"
},
{
"status": "affected",
"version": "16.12.14"
},
{
"status": "affected",
"version": "17.18.1z"
},
{
"status": "affected",
"version": "17.9.7b"
},
{
"status": "affected",
"version": "17.12.5c"
},
{
"status": "affected",
"version": "26.1.1"
},
{
"status": "affected",
"version": "17.18.1a"
},
{
"status": "affected",
"version": "17.15.4a"
},
{
"status": "affected",
"version": "17.18.2"
},
{
"status": "affected",
"version": "17.18.1w"
},
{
"status": "affected",
"version": "17.15.4b"
},
{
"status": "affected",
"version": "17.12.6a"
},
{
"status": "affected",
"version": "17.12.7"
},
{
"status": "affected",
"version": "17.15.4c"
},
{
"status": "affected",
"version": "17.9.9"
},
{
"status": "affected",
"version": "17.12.5d"
},
{
"status": "affected",
"version": "16.12.15"
},
{
"status": "affected",
"version": "17.15.4s1"
},
{
"status": "affected",
"version": "17.15.5"
},
{
"status": "affected",
"version": "17.12.1z5"
},
{
"status": "affected",
"version": "17.18.1x"
},
{
"status": "affected",
"version": "17.12.1z6"
},
{
"status": "affected",
"version": "17.15.4d"
},
{
"status": "affected",
"version": "17.12.6b"
},
{
"status": "affected",
"version": "17.4.1c"
},
{
"status": "affected",
"version": "3.11.14E"
},
{
"status": "affected",
"version": "17.15.5a"
},
{
"status": "affected",
"version": "17.18.1y"
},
{
"status": "affected",
"version": "17.12.7a"
},
{
"status": "affected",
"version": "17.18.3"
},
{
"status": "affected",
"version": "17.12.7b"
},
{
"status": "affected",
"version": "17.18.3a"
},
{
"status": "affected",
"version": "26.1.1a"
},
{
"status": "affected",
"version": "26.2.1ea"
},
{
"status": "affected",
"version": "16.12.16"
}
]
},
{
"defaultStatus": "unknown",
"product": "IOS",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "15.2(7)E7"
},
{
"status": "affected",
"version": "15.2(8)E3"
},
{
"status": "affected",
"version": "15.7(3)M10"
},
{
"status": "affected",
"version": "15.8(3)M9"
},
{
"status": "affected",
"version": "15.9(3)M7"
},
{
"status": "affected",
"version": "15.2(7)E8"
},
{
"status": "affected",
"version": "15.2(8)E4"
},
{
"status": "affected",
"version": "15.9(3)M7a"
},
{
"status": "affected",
"version": "15.2(2)E10c"
},
{
"status": "affected",
"version": "15.2(4)E10d"
},
{
"status": "affected",
"version": "15.9(3)M6a"
},
{
"status": "affected",
"version": "15.9(3)M6b"
},
{
"status": "affected",
"version": "15.5(1)SY10"
},
{
"status": "affected",
"version": "15.5(1)SY11"
},
{
"status": "affected",
"version": "15.2(6)E1a"
},
{
"status": "affected",
"version": "15.4(1)SY4"
},
{
"status": "affected",
"version": "15.5(1)SY1"
},
{
"status": "affected",
"version": "15.2(2)E8"
},
{
"status": "affected",
"version": "15.2(6)E1"
},
{
"status": "affected",
"version": "15.7(3)M2"
},
{
"status": "affected",
"version": "15.2(4)E6"
},
{
"status": "affected",
"version": "15.2(1)SY6"
},
{
"status": "affected",
"version": "15.2(4)EA7"
},
{
"status": "affected",
"version": "15.2(6)E1s"
},
{
"status": "affected",
"version": "15.7(3)M3"
},
{
"status": "affected",
"version": "15.8(3)M"
},
{
"status": "affected",
"version": "15.2(1)SY7"
},
{
"status": "affected",
"version": "15.2(4)EA8"
},
{
"status": "affected",
"version": "15.8(3)M0a"
},
{
"status": "affected",
"version": "15.2(2)E9"
},
{
"status": "affected",
"version": "15.2(6)E2"
},
{
"status": "affected",
"version": "15.5(1)SY2"
},
{
"status": "affected",
"version": "15.2(4)E7"
},
{
"status": "affected",
"version": "15.2(6)E2a"
},
{
"status": "affected",
"version": "15.2(2)E9a"
},
{
"status": "affected",
"version": "15.8(3)M0b"
},
{
"status": "affected",
"version": "15.2(6)E2b"
},
{
"status": "affected",
"version": "15.8(3)M1"
},
{
"status": "affected",
"version": "15.8(3)M1a"
},
{
"status": "affected",
"version": "15.7(3)M4"
},
{
"status": "affected",
"version": "15.2(1)SY8"
},
{
"status": "affected",
"version": "15.2(4)E8"
},
{
"status": "affected",
"version": "15.5(1)SY3"
},
{
"status": "affected",
"version": "15.2(7)E"
},
{
"status": "affected",
"version": "15.7(3)M4a"
},
{
"status": "affected",
"version": "15.8(3)M2"
},
{
"status": "affected",
"version": "15.2(7)E0a"
},
{
"status": "affected",
"version": "15.8(3)M2a"
},
{
"status": "affected",
"version": "15.7(3)M4b"
},
{
"status": "affected",
"version": "15.2(2)E10"
},
{
"status": "affected",
"version": "15.2(7)E0s"
},
{
"status": "affected",
"version": "15.2(4)EA9"
},
{
"status": "affected",
"version": "15.2(7)E0b"
},
{
"status": "affected",
"version": "15.2(6)E3"
},
{
"status": "affected",
"version": "15.9(3)M"
},
{
"status": "affected",
"version": "15.8(3)M3"
},
{
"status": "affected",
"version": "15.5(1)SY4"
},
{
"status": "affected",
"version": "15.7(3)M5"
},
{
"status": "affected",
"version": "15.2(2)E10a"
},
{
"status": "affected",
"version": "15.2(4)E9"
},
{
"status": "affected",
"version": "15.2(7)E1"
},
{
"status": "affected",
"version": "15.8(3)M3b"
},
{
"status": "affected",
"version": "15.9(3)M0a"
},
{
"status": "affected",
"version": "15.2(7)E1a"
},
{
"status": "affected",
"version": "15.2(4)E10"
},
{
"status": "affected",
"version": "15.5(1)SY5"
},
{
"status": "affected",
"version": "15.2(4)EA9a"
},
{
"status": "affected",
"version": "15.9(3)M1"
},
{
"status": "affected",
"version": "15.8(3)M4"
},
{
"status": "affected",
"version": "15.7(3)M6"
},
{
"status": "affected",
"version": "15.2(7)E2"
},
{
"status": "affected",
"version": "15.5(1)SY6"
},
{
"status": "affected",
"version": "15.2(7)E3"
},
{
"status": "affected",
"version": "15.8(3)M5"
},
{
"status": "affected",
"version": "15.7(3)M7"
},
{
"status": "affected",
"version": "15.9(3)M2"
},
{
"status": "affected",
"version": "15.2(7)E2b"
},
{
"status": "affected",
"version": "15.9(3)M2a"
},
{
"status": "affected",
"version": "15.2(4)E10a"
},
{
"status": "affected",
"version": "15.2(7)E4"
},
{
"status": "affected",
"version": "15.5(1)SY7"
},
{
"status": "affected",
"version": "15.2(4)E10b"
},
{
"status": "affected",
"version": "15.2(7)E3k"
},
{
"status": "affected",
"version": "15.2(8)E"
},
{
"status": "affected",
"version": "15.9(3)M3"
},
{
"status": "affected",
"version": "15.8(3)M6"
},
{
"status": "affected",
"version": "15.7(3)M8"
},
{
"status": "affected",
"version": "15.8(3)M7"
},
{
"status": "affected",
"version": "15.5(1)SY8"
},
{
"status": "affected",
"version": "15.2(7)E5"
},
{
"status": "affected",
"version": "15.2(8)E1"
},
{
"status": "affected",
"version": "15.9(3)M4"
},
{
"status": "affected",
"version": "15.2(8)E2"
},
{
"status": "affected",
"version": "15.2(4)E10c"
},
{
"status": "affected",
"version": "15.7(3)M9"
},
{
"status": "affected",
"version": "15.2(2)E10b"
},
{
"status": "affected",
"version": "15.2(7)E6"
},
{
"status": "affected",
"version": "15.9(3)M4a"
},
{
"status": "affected",
"version": "15.5(1)SY9"
},
{
"status": "affected",
"version": "15.9(3)M5"
},
{
"status": "affected",
"version": "15.8(3)M8"
},
{
"status": "affected",
"version": "15.9(3)M6"
},
{
"status": "affected",
"version": "15.9(3)M9"
},
{
"status": "affected",
"version": "15.5(1)SY13"
},
{
"status": "affected",
"version": "15.9(3)M8b"
},
{
"status": "affected",
"version": "15.2(7)E9"
},
{
"status": "affected",
"version": "15.5(1)SY12"
},
{
"status": "affected",
"version": "15.7(3)M10a"
},
{
"status": "affected",
"version": "15.9(3)M8"
},
{
"status": "affected",
"version": "15.9(3)M8a"
},
{
"status": "affected",
"version": "15.2(8)E5"
},
{
"status": "affected",
"version": "15.2(7)E10"
},
{
"status": "affected",
"version": "15.7(3)M10b"
},
{
"status": "affected",
"version": "15.9(3)M3a"
},
{
"status": "affected",
"version": "15.8(3)M3a"
},
{
"status": "affected",
"version": "15.9(3)M3b"
},
{
"status": "affected",
"version": "15.6(2)SP7"
},
{
"status": "affected",
"version": "15.6(2)SP5"
},
{
"status": "affected",
"version": "15.6(2)SP8"
},
{
"status": "affected",
"version": "15.6(2)SP6"
},
{
"status": "affected",
"version": "15.6(2)SP4"
},
{
"status": "affected",
"version": "15.6(2)SP9"
},
{
"status": "affected",
"version": "15.6(2)SP8a"
},
{
"status": "affected",
"version": "15.9(3)M9a"
},
{
"status": "affected",
"version": "15.2(8)E6"
},
{
"status": "affected",
"version": "15.9(3)M10"
},
{
"status": "affected",
"version": "15.2(7)E11"
},
{
"status": "affected",
"version": "15.5(1)SY14"
},
{
"status": "affected",
"version": "15.2(8)E7"
},
{
"status": "affected",
"version": "15.2(4)E10e"
},
{
"status": "affected",
"version": "15.9(3)M11"
},
{
"status": "affected",
"version": "15.2(7)E12"
},
{
"status": "affected",
"version": "15.5(1)SY15"
},
{
"status": "affected",
"version": "15.2(8)E8"
},
{
"status": "affected",
"version": "15.5(1)SY16"
},
{
"status": "affected",
"version": "15.2(7)E13"
},
{
"status": "affected",
"version": "15.9(3)M12"
},
{
"status": "affected",
"version": "15.5(1)SY17"
},
{
"status": "affected",
"version": "15.2(7)E14"
},
{
"status": "affected",
"version": "15.9(3)M13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "Unchecked Input for Loop Condition",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:28:37.635Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ios-xmcp-thbAr34t",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t"
}
],
"source": {
"advisory": "cisco-sa-ios-xmcp-thbAr34t",
"defects": [
"CSCwu20827"
],
"discovery": "INTERNAL"
},
"title": "Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20301",
"datePublished": "2026-08-05T16:28:37.635Z",
"dateReserved": "2025-10-08T11:59:15.408Z",
"dateUpdated": "2026-08-05T17:45:13.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16652 (GCVE-0-2026-16652)
Vulnerability from cvelistv5 – Published: 2026-09-21 11:23 – Updated: 2026-09-21 15:33
VLAI
EPSS
VEX
Title
Temporal Server Schedule exclusion search can cause excessive CPU consumption
Summary
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:32 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/temporalio/temporal/pull/11014 | patch |
| https://github.com/temporalio/temporal/commit/c10… | patch |
| https://github.com/temporalio/temporal/releases/t… | release-notes |
| https://github.com/temporalio/temporal/releases/t… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server |
Affected:
1.17.0 , ≤ 1.29.7
(semver)
Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:53.335177Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:33:15.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Schedules"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/worker/scheduler/spec.go"
],
"programRoutines": [
{
"name": "CompiledSpec.GetNextTime"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.17.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTemporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\u003c/p\u003e"
}
],
"value": "Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:23:47.298Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "Fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11014"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\u003c/p\u003e"
}
],
"value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\u003c/p\u003e"
}
],
"value": "Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16652",
"datePublished": "2026-09-21T11:23:47.298Z",
"dateReserved": "2026-07-22T18:08:55.806Z",
"dateUpdated": "2026-09-21T15:33:15.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16599 (GCVE-0-2026-16599)
Vulnerability from cvelistv5 – Published: 2026-08-25 14:17 – Updated: 2026-08-25 14:51
VLAI
EPSS
VEX
Title
Denial of Service in GNU wget
Summary
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:38 UTC
CWE
- CWE-606 - Unchecked input for loop condition
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2026/08/CVE-2026-16599 | third-party-advisory |
| https://gitlab.com/gnuwget/wget | product |
| https://gitlab.com/gnuwget/wget/-/commit/e9697d98… | patch |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:38:32.531936Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:51:53.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "wget",
"repo": "https://gitlab.com/gnuwget/wget/",
"vendor": "GNU",
"versions": [
{
"lessThanOrEqual": "1.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Majchrowicz (AFINE Team)"
},
{
"lang": "en",
"type": "finder",
"value": "Marcin Wyczechowski (AFINE Team)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa\u003c/div\u003e"
}
],
"value": "GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606 Unchecked input for loop condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:17:04.941Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2026/08/CVE-2026-16599"
},
{
"tags": [
"product"
],
"url": "https://gitlab.com/gnuwget/wget"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of Service in GNU wget",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-16599",
"datePublished": "2026-08-25T14:17:04.941Z",
"dateReserved": "2026-07-22T14:11:18.939Z",
"dateUpdated": "2026-08-25T14:51:53.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15172 (GCVE-0-2026-15172)
Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:42
VLAI
EPSS
VEX
Title
Unchecked Input for Loop Condition in Wireshark
Summary
FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 13:42 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wireshark Foundation | Wireshark |
Affected:
4.6.0 , < 4.6.7
(semver)
Affected: 4.4.0 , < 4.4.17 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T13:42:40.189292Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T13:42:52.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.7",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.17",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gabriel Rodrigues"
}
],
"descriptions": [
{
"lang": "en",
"value": "FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T20:51:20.287Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://www.wireshark.org/security/wnpa-sec-2026-54.html"
},
{
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21347"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 4.6.7 or above"
}
],
"title": "Unchecked Input for Loop Condition in Wireshark"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-15172",
"datePublished": "2026-07-08T20:51:20.287Z",
"dateReserved": "2026-07-08T20:45:58.875Z",
"dateUpdated": "2026-07-09T13:42:52.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13761 (GCVE-0-2026-13761)
Vulnerability from cvelistv5 – Published: 2026-08-28 13:11 – Updated: 2026-08-28 18:25
VLAI
EPSS
VEX
Title
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Summary
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:25 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Pegasystems | Pega Infinity |
Affected:
7.1.0 , < Infinity 25.1.3
(custom)
|
Date Public
2026-08-28 20:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:25:07.045779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:25:21.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pega Infinity",
"vendor": "Pegasystems",
"versions": [
{
"lessThan": "Infinity 25.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Barbaccia and Davide Bresaola from HWG Sababa"
}
],
"datePublic": "2026-08-28T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003ePega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130: Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T13:11:34.206Z",
"orgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9",
"shortName": "Pega"
},
"references": [
{
"url": "https://support.pega.com/support-doc/pega-security-advisory-n26-vulnerability-remediation-note"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c91e5604-2bd1-401f-a0ec-b25342b57ef9",
"assignerShortName": "Pega",
"cveId": "CVE-2026-13761",
"datePublished": "2026-08-28T13:11:34.206Z",
"dateReserved": "2026-06-29T18:24:41.533Z",
"dateUpdated": "2026-08-28T18:25:21.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11972 (GCVE-0-2026-11972)
Vulnerability from cvelistv5 – Published: 2026-06-23 22:02 – Updated: 2026-08-13 00:28
VLAI
EPSS
VEX
Title
tarfile opened in streaming mode mishandles EOF
Summary
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-24 15:33 UTC
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Python Software Foundation | CPython |
Affected:
0 , < 3.10.21
(python)
Affected: 3.11.0 , < 3.11.16 (python) Affected: 3.12.0 , < 3.12.14 (python) Affected: 3.13.0 , < 3.13.15 (python) Affected: 3.14.0 , < 3.14.7 (python) Affected: 3.15.0a1 , < 3.15.0b4 (python) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11972",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-24T15:33:49.665045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T15:34:06.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"tarfile"
],
"product": "CPython",
"repo": "https://github.com/python/cpython",
"vendor": "Python Software Foundation",
"versions": [
{
"lessThan": "3.10.21",
"status": "affected",
"version": "0",
"versionType": "python"
},
{
"lessThan": "3.11.16",
"status": "affected",
"version": "3.11.0",
"versionType": "python"
},
{
"lessThan": "3.12.14",
"status": "affected",
"version": "3.12.0",
"versionType": "python"
},
{
"lessThan": "3.13.15",
"status": "affected",
"version": "3.13.0",
"versionType": "python"
},
{
"lessThan": "3.14.7",
"status": "affected",
"version": "3.14.0",
"versionType": "python"
},
{
"lessThan": "3.15.0b4",
"status": "affected",
"version": "3.15.0a1",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ryan Hileman (https://github.com/lunixbochs)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Petr Viktorin (https://github.com/encukou)"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Stan Ulbrych (https://github.com/StanFromIreland)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"value": "When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."
}
],
"value": "When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-606",
"description": "CWE-606",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T00:28:46.899Z",
"orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
"shortName": "PSF"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/python/cpython/issues/151981"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/pull/151982"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896"
},
{
"tags": [
"patch"
],
"url": "https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tarfile opened in streaming mode mishandles EOF",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
"assignerShortName": "PSF",
"cveId": "CVE-2026-11972",
"datePublished": "2026-06-23T22:02:45.434Z",
"dateReserved": "2026-06-11T11:35:05.520Z",
"dateUpdated": "2026-08-13T00:28:46.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5950 (GCVE-0-2026-5950)
Vulnerability from cvelistv5 – Published: 2026-05-20 13:10 – Updated: 2026-05-20 13:38
VLAI
EPSS
VEX
Title
Unbounded resend loop in BIND 9 resolver
Summary
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.
This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 13:38 UTC
CWE
- CWE-606 - Unchecked Input for Loop Condition
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://kb.isc.org/docs/cve-2026-5950 | vendor-advisory |
| https://downloads.isc.org/isc/bind9/9.18.49 | patch |
| https://downloads.isc.org/isc/bind9/9.20.23 | patch |
| https://downloads.isc.org/isc/bind9/9.21.22 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ISC | BIND 9 |
Affected:
9.18.36 , ≤ 9.18.48
(custom)
Affected: 9.20.8 , ≤ 9.20.22 (custom) Affected: 9.21.7 , ≤ 9.21.21 (custom) Affected: 9.18.36-S1 , ≤ 9.18.48-S1 (custom) Affected: 9.20.9-S1 , ≤ 9.20.22-S1 (custom) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* |
Date Public
2026-05-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T13:38:40.421994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T13:38:53.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BIND 9",
"vendor": "ISC",
"versions": [
{
"lessThanOrEqual": "9.18.48",
"status": "affected",
"version": "9.18.36",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.20.22",
"status": "affected",
"version": "9.20.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.21.21",
"status": "affected",
"version": "9.21.7",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.18.48-S1",
"status": "affected",
"version": "9.18.36-S1",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.20.22-S1",
"status": "affected",
"version": "9.20.9-S1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.18.48",
"versionStartIncluding": "9.18.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.20.22",
"versionStartIncluding": "9.20.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.21.21",
"versionStartIncluding": "9.21.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.18.48-S1",
"versionStartIncluding": "9.18.36-S1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.20.22-S1",
"versionStartIncluding": "9.20.9-S1",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "ISC would like to thank Billy Baraja (BielraX) for bringing this vulnerability to our attention."
}
],
"datePublic": "2026-05-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.\nThis issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1."
}
],
"exploits": [
{
"lang": "en",
"value": "We are not aware of any active exploits."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Severe resource exhaustion."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606 Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T13:10:19.989Z",
"orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
"shortName": "isc"
},
"references": [
{
"name": "CVE-2026-5950",
"tags": [
"vendor-advisory"
],
"url": "https://kb.isc.org/docs/cve-2026-5950"
},
{
"tags": [
"patch"
],
"url": "https://downloads.isc.org/isc/bind9/9.18.49"
},
{
"tags": [
"patch"
],
"url": "https://downloads.isc.org/isc/bind9/9.20.23"
},
{
"tags": [
"patch"
],
"url": "https://downloads.isc.org/isc/bind9/9.21.22"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded resend loop in BIND 9 resolver",
"workarounds": [
{
"lang": "en",
"value": "No workarounds known."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
"assignerShortName": "isc",
"cveId": "CVE-2026-5950",
"datePublished": "2026-05-20T13:10:19.989Z",
"dateReserved": "2026-04-09T06:42:23.953Z",
"dateUpdated": "2026-05-20T13:38:53.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Do not use user-controlled data for loop conditions.
Mitigation
Implementation
Perform input validation.
No CAPEC attack patterns related to this CWE.