https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 03:12:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-331205 EUVD-2026-331205 https://cve.radiocsirt.org/vuln/euvd-2026-331205 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56018 <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56018 https://cve.radiocsirt.org/vuln/ghsa-fvxv-8c37-qrc6 <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> https://cve.radiocsirt.org/vuln/ghsa-fvxv-8c37-qrc6 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11158-1 <p>perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media</p> <p>perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11158-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56018 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:18.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:20.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:22.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:24.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:25.10: libjavascript-minifier-xs-perl, Ubuntu:26.04:LTS: libjavascript-minifier-xs-perl</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:18.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:20.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:22.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:24.04:LTS: libjavascript-minifier-xs-perl, Ubuntu:25.10: libjavascript-minifier-xs-perl, Ubuntu:26.04:LTS: libjavascript-minifier-xs-perl</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56018