https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:16:43 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/cleanstart-2026-ea45070 <p><strong>Affected:</strong> CleanStart: argo-workflows, CleanStart: n8n</p> <p>CVE-2026-59887 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows, CleanStart: n8n</p> <p>CVE-2026-59887 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ea45070 https://cve.radiocsirt.org/vuln/euvd-2026-335370 EUVD-2026-335370 https://cve.radiocsirt.org/vuln/euvd-2026-335370 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59887 <p>linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.</p> <p>linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59887 https://cve.radiocsirt.org/vuln/ghsa-v245-v573-v5vm <p><strong>Affected:</strong> npm: linkify-it</p> <p>### Summary `linkify-it`&#39;s schema-scan loop (`.test()` / `.match()`, the documented public API) invokes the `mailto:` schema validator at **every** `mailto:` occurrence in the input text. For each occurrence the validator does `text.slice(pos)` (an O(n) copy) and runs an email regex whose local-part class `src_email_name` greedily scans the **entire remaining tail** (O(n)) before failing. With N `mailto:` occurrences that is **N × O(n) = O(n²)**. Because linkify-it runs on arbitrary user text (markdown-it feeds it whole documents when `linkify:true`), an unauthenticated attacker can block the single-threaded event loop for many seconds with a small input. No length bound (unlike an HTTP header).</p> <p>### Root cause — `index.mjs` + `lib/re.mjs` ```js // index.mjs (mailto validator) — runs at every &#34;mailto:&#34; hit &#39;mailto:&#39;: { validate: function (text, pos, self) { const tail = text.slice(pos) // O(n) copy per hit if (!self.re.mailto) self.re.mailto = new RegExp(&#39;^&#39; + self.re.src_email_name + &#39;@&#39; + self.re.src_host_strict, &#39;i&#39;) if (self.re.mailto.test(tail)) { ... } // scans the whole O(n) tail return 0 }} // lib/re.mjs:91-93 — every char of &#34;mailto:&#34; (incl. &#39;:&#39;,&#39;-&#39;,&#39;;&#39;) is in this class: re.src_email_name = &#39;[\\-;:&amp;=\\+\\$,\\.a-zA-Z0-9_][\\-;:&amp;=\\+\\$,\\&#34;\\.a-zA-Z0-9_]*&#39; ``` The `while ((m = re.exec(text)) !== null) { …testSchemaAt… }` scan loop calls the validator at each `mailto:` hit; `src_email_name` greedily consu…</p> <p><strong>Affected:</strong> npm: linkify-it</p> <p>### Summary `linkify-it`&#39;s schema-scan loop (`.test()` / `.match()`, the documented public API) invokes the `mailto:` schema validator at **every** `mailto:` occurrence in the input text. For each occurrence the validator does `text.slice(pos)` (an O(n) copy) and runs an email regex whose local-part class `src_email_name` greedily scans the **entire remaining tail** (O(n)) before failing. With N `mailto:` occurrences that is **N × O(n) = O(n²)**. Because linkify-it runs on arbitrary user text (markdown-it feeds it whole documents when `linkify:true`), an unauthenticated attacker can block the single-threaded event loop for many seconds with a small input. No length bound (unlike an HTTP header).</p> <p>### Root cause — `index.mjs` + `lib/re.mjs` ```js // index.mjs (mailto validator) — runs at every &#34;mailto:&#34; hit &#39;mailto:&#39;: { validate: function (text, pos, self) { const tail = text.slice(pos) // O(n) copy per hit if (!self.re.mailto) self.re.mailto = new RegExp(&#39;^&#39; + self.re.src_email_name + &#39;@&#39; + self.re.src_host_strict, &#39;i&#39;) if (self.re.mailto.test(tail)) { ... } // scans the whole O(n) tail return 0 }} // lib/re.mjs:91-93 — every char of &#34;mailto:&#34; (incl. &#39;:&#39;,&#39;-&#39;,&#39;;&#39;) is in this class: re.src_email_name = &#39;[\\-;:&amp;=\\+\\$,\\.a-zA-Z0-9_][\\-;:&amp;=\\+\\$,\\&#34;\\.a-zA-Z0-9_]*&#39; ``` The `while ((m = re.exec(text)) !== null) { …testSchemaAt… }` scan loop calls the validator at each `mailto:` hit; `src_email_name` greedily consu…</p> https://cve.radiocsirt.org/vuln/ghsa-v245-v573-v5vm https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/rhsa-2026:68754 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports postcss: PostCSS: Information disclosure and denial of service via crafted CSS input baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak linkify-it: linkify-it: Denial of Service via crafted mailto: links io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) nanoid: nanoid: Denial of Service via infinite loop in random ID generation axios: axios: Denial of Service via uncontrolled recursion in form data processing axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter a…</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports postcss: PostCSS: Information disclosure and denial of service via crafted CSS input baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak linkify-it: linkify-it: Denial of Service via crafted mailto: links io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) nanoid: nanoid: Denial of Service via infinite loop in random ID generation axios: axios: Denial of Service via uncontrolled recursion in form data processing axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter a…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68754 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2923 <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2923