https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:01:27 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-331341 EUVD-2026-331341 https://cve.radiocsirt.org/vuln/euvd-2026-331341 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45822 <p>decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on &#39;%&#39; producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 &#39;%ab&#39; tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.</p> <p>decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on &#39;%&#39; producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 &#39;%ab&#39; tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45822 https://cve.radiocsirt.org/vuln/ghsa-vcc3-ghjq-m6fr <p><strong>Affected:</strong> npm: decode-uri-component</p> <p>### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.</p> <p>### Patches Upgrade to `decode-uri-component@0.5.0`.</p> <p>### Workarounds Limit the size of the input.</p> <p><strong>Affected:</strong> npm: decode-uri-component</p> <p>### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.</p> <p>### Patches Upgrade to `decode-uri-component@0.5.0`.</p> <p>### Workarounds Limit the size of the input.</p> https://cve.radiocsirt.org/vuln/ghsa-vcc3-ghjq-m6fr https://cve.radiocsirt.org/vuln/rhsa-2026:40262 <p>form-data: form-data: Form field override via CRLF injection fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/crypto/ssh/knownhosts: golang: golang…</p> <p>form-data: form-data: Form field override via CRLF injection fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint net/mail: golang: net/mail: Denial of Service via pathological email address parsing golang.org/x/crypto/ssh/knownhosts: golang: golang…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:40262 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45822 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-source-map-resolve, Ubuntu:24.04:LTS: node-source-map-resolve, Ubuntu:25.10: node-source-map-resolve, Ubuntu:26.04:LTS: node-source-map-resolve</p> <p>decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on &#39;%&#39; producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 &#39;%ab&#39; tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-source-map-resolve, Ubuntu:24.04:LTS: node-source-map-resolve, Ubuntu:25.10: node-source-map-resolve, Ubuntu:26.04:LTS: node-source-map-resolve</p> <p>decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on &#39;%&#39; producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 &#39;%ab&#39; tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45822