Most recent entries from all

EUVD-2026-334003

fkie_cve-2026-59870

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.

GHSA-724g-mxrg-4qvm — js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Affected: npm: js-yaml

### Summary `js-yaml` v5.x introduces `YAML11_SCHEMA` support with the `!!omap` (ordered map) tag. The `omapTag.addItem()` function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses `yaml.load()` with `{ schema: yaml.YAML11_SCHEMA }`.

### Details In `src/tag/sequence/omap.ts` (compiled: `dist/js-yaml.cjs.js:510-525`): ```js var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', { create: () => [], addItem: (container, item) => { // ... for (const existing of container) // O(n) per insertion! if (hasOwnProperty(existing, itemKeys[0])) return 'cannot resolve an ordered map item'; container.push(object); // n insertions → O(n^2) total return ''; } }); ``` For a document with `n` unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = **O(n²)** total work.

### PoC (runtime-confirmed on v5.2.0) ```js const yaml = require('js-yaml'); function buildOmapPayload(n) { let p = '!!omap\n'; for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\n'; return p; } // Timing results on v5.2.0: // n=1000: 9ms // n=5000: 73ms (5x n → 8x time) // n=10000: 255ms (2x n → 3.5x time — supralinear) // n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed) // n=50000: 1…

RHSA-2026:26994 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

UBUNTU-CVE-2026-59870

Affected: Ubuntu:18.04:LTS: node-js-yaml, Ubuntu:20.04:LTS: node-js-yaml, Ubuntu:22.04:LTS: node-js-yaml, Ubuntu:24.04:LTS: node-js-yaml, Ubuntu:25.10: node-js-yaml, Ubuntu:26.04:LTS: node-js-yaml

WID-SEC-W-2026-3221 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.