https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:23:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07237 bdu:2026-07237 https://cve.radiocsirt.org/vuln/bdu:2026-07237 https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-33176 <p><strong>Affected:</strong> Homebrew: krane</p> <p>### Impact Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [manun](https://hackerone.com/manun).</p> <p><strong>Affected:</strong> Homebrew: krane</p> <p>### Impact Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [manun](https://hackerone.com/manun).</p> https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-33176 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0349 https://cve.radiocsirt.org/vuln/euvd-2026-277265 EUVD-2026-277265 https://cve.radiocsirt.org/vuln/euvd-2026-277265 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33176 <p>Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> <p>Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33176 https://cve.radiocsirt.org/vuln/ghsa-2j26-frm8-cmj9 <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>### Impact Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [manun](https://hackerone.com/manun).</p> <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>### Impact Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.</p> <p>### Releases The fixed releases are available at the normal locations.</p> <p>### Credit This issue was responsibly reported by Hackerone researcher [manun](https://hackerone.com/manun).</p> https://cve.radiocsirt.org/vuln/ghsa-2j26-frm8-cmj9 https://cve.radiocsirt.org/vuln/rhsa-2026:14835 <p>Django: Django: Denial of Service via crafted request with duplicate headers python-markdown: denial of service via malformed HTML-like sequences Django: Django: SQL Injection via RasterField band index parameter Django: Django: Denial of Service via crafted HTML inputs Django: Django: SQL Injection via crafted column aliases Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() pyOpenSSL: DTLS cookie callback buffer overflow Rails: Active Support: Active Support: Denial of Service via large scientific notation strings</p> <p>Django: Django: Denial of Service via crafted request with duplicate headers python-markdown: denial of service via malformed HTML-like sequences Django: Django: SQL Injection via RasterField band index parameter Django: Django: Denial of Service via crafted HTML inputs Django: Django: SQL Injection via crafted column aliases Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() pyOpenSSL: DTLS cookie callback buffer overflow Rails: Active Support: Active Support: Denial of Service via large scientific notation strings</p> https://cve.radiocsirt.org/vuln/rhsa-2026:14835 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33176 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails</p> <p>Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33176 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833 <p>Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0833