https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:35:09 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:21286 <p><strong>Affected:</strong> AlmaLinux:10: aspnetcore-runtime-8.0, AlmaLinux:10: aspnetcore-runtime-dbg-8.0, AlmaLinux:10: aspnetcore-targeting-pack-8.0, AlmaLinux:10: dotnet-apphost-pack-8.0, AlmaLinux:10: dotnet-hostfxr-8.0, AlmaLinux:10: dotnet-runtime-8.0, AlmaLinux:10: dotnet-runtime-dbg-8.0, AlmaLinux:10: dotnet-sdk-8.0, AlmaLinux:10: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:10: dotnet-sdk-dbg-8.0 and 2 more</p> <p>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.</p> <p>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):</p> <p>* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: aspnetcore-runtime-8.0, AlmaLinux:10: aspnetcore-runtime-dbg-8.0, AlmaLinux:10: aspnetcore-targeting-pack-8.0, AlmaLinux:10: dotnet-apphost-pack-8.0, AlmaLinux:10: dotnet-hostfxr-8.0, AlmaLinux:10: dotnet-runtime-8.0, AlmaLinux:10: dotnet-runtime-dbg-8.0, AlmaLinux:10: dotnet-sdk-8.0, AlmaLinux:10: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:10: dotnet-sdk-dbg-8.0 and 2 more</p> <p>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.</p> <p>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):</p> <p>* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:21286 https://cve.radiocsirt.org/vuln/bdu:2026-10881 bdu:2026-10881 https://cve.radiocsirt.org/vuln/bdu:2026-10881 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 https://cve.radiocsirt.org/vuln/euvd-2026-278255 EUVD-2026-278255 https://cve.radiocsirt.org/vuln/euvd-2026-278255 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34043 <p>Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.</p> <p>Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34043 https://cve.radiocsirt.org/vuln/ghsa-qj8w-gfj5-8c6v <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>**What kind of vulnerability is it?**</p> <p>It is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.</p> <p>**Who is impacted?**</p> <p>Applications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object.</p> <p>### Patches</p> <p>**Has the problem been patched?**</p> <p>Yes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection.</p> <p>**What versions should users upgrade to?**</p> <p>Users should upgrade to **`v7.0.5`** or later.</p> <p>### Workarounds</p> <p>**Is there a way for users to fix or remediate the vulnerability without upgrading?**</p> <p>There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:</p> <p>* Validating and sanitizing all input before passing it to the `serialize()` function. * Ensuring the environment is protected against Prototype Pollution. * Upgrading to **`v7.0.5`** as soon as possible.</p> <p>### Acknowledgements</p> <p>Serialize JavaScript thanks *…</p> <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>**What kind of vulnerability is it?**</p> <p>It is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.</p> <p>**Who is impacted?**</p> <p>Applications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object.</p> <p>### Patches</p> <p>**Has the problem been patched?**</p> <p>Yes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection.</p> <p>**What versions should users upgrade to?**</p> <p>Users should upgrade to **`v7.0.5`** or later.</p> <p>### Workarounds</p> <p>**Is there a way for users to fix or remediate the vulnerability without upgrading?**</p> <p>There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:</p> <p>* Validating and sanitizing all input before passing it to the `serialize()` function. * Ensuring the environment is protected against Prototype Pollution. * Upgrading to **`v7.0.5`** as soon as possible.</p> <p>### Acknowledgements</p> <p>Serialize JavaScript thanks *…</p> https://cve.radiocsirt.org/vuln/ghsa-qj8w-gfj5-8c6v https://cve.radiocsirt.org/vuln/msrc_cve-2026-34043 msrc_CVE-2026-34043 https://cve.radiocsirt.org/vuln/msrc_cve-2026-34043 https://cve.radiocsirt.org/vuln/rhsa-2026:17448 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> https://cve.radiocsirt.org/vuln/rhsa-2026:17448 https://cve.radiocsirt.org/vuln/rhsa-2026:21286 <p>serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization dotnet: .NET: infinite loop allows an attacker to cause a denial of service</p> <p>serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization dotnet: .NET: infinite loop allows an attacker to cause a denial of service</p> https://cve.radiocsirt.org/vuln/rhsa-2026:21286 https://cve.radiocsirt.org/vuln/rlsa-2026:21286 <p><strong>Affected:</strong> Rocky Linux:10: dotnet8.0</p> <p>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.</p> <p>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):</p> <p>* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)</p> <p>* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: dotnet8.0</p> <p>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.</p> <p>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):</p> <p>* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)</p> <p>* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:21286 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34043 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-serialize-javascript, Ubuntu:24.04:LTS: node-serialize-javascript, Ubuntu:25.10: node-serialize-javascript, Ubuntu:26.04:LTS: node-serialize-javascript</p> <p>Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-serialize-javascript, Ubuntu:24.04:LTS: node-serialize-javascript, Ubuntu:25.10: node-serialize-javascript, Ubuntu:26.04:LTS: node-serialize-javascript</p> <p>Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted &#34;array-like&#34; object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-34043 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1058 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1058