Apache mod_md NULL dereference can crash a child process
Apache rates CVE-2026-106023 important; the body limits it to 2.4.30 through 2.4.69.
Stories per day · 30 days
26 RSS
Relatedubuntu39cisco15perl14android9asa9dns9apache8ftd8gpac8mp4box8apache-kafka7ssl-vpn7ics6linux-kernel6usn6fortinet5heap-overflow5null-dereference5
332 stories, newest first · one card per story
Stories tagged #denial-of-service
Microsoft discloses Active Directory remote code execution and denial-of-service flaws
Both Important-rated flaws need low privileges; the record does not show an active exploitation campaign.
Ubuntu fixes Linux kernel io_uring flaws enabling local denial of service
CVE-2026-80811 can exhaust memory and CVE-2026-81009 can hang the system; a third issue is only partly described.
DataSketches Java through 9.0.0 can exhaust memory on crafted input
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
Ubuntu fixes GStreamer plugin flaws that can crash or run code
Network-stream and Matroska issues are limited to Ubuntu 16.04, 18.04, and 20.04 LTS; the notice is cut off.
Ubuntu 26.10 gets Unbound fixes from USN-8946-1
CVE-2026-80225 can let a remote attacker exhaust Unbound resources over TCP on listed LTS releases.
Progress patches five high-severity flaws in WS_FTP Server
The recommended build is 2025.0.5, also called 10.0.5; the notice reports no active exploitation.
sblim-sfcb CIM-XML parser bug enables pre-auth remote denial of service
Espilon VR is seeking a CVE because upstream sfcb, last released as 1.4.9 in 2017, is abandoned.
FortiAuthenticator flaw may let attackers exhaust resources
Fortinet rates the unauthenticated CWE-770 issue 7.5; the November 10 note gives no versions, fix, or CVE.
Ubuntu warns of Apache HTTP Server DoS and cookie leak
CVE-2026-46729 affects Ubuntu 14.04 LTS through 26.04 LTS; the snippet states no fixed versions.
Ubuntu fixes libsoup cookie-jar leak from USN-8890-1
The follow-up also restates HTTP/2 denial of service and HTTPS proxy disclosure, including CVE-2026-4271.
Monoceros before 0.30 can exhaust memory via Content-Length
A request that declares a large Content-Length can kill a Monoceros worker by exhausting memory.
Ubuntu fixes OpenJDK 27 flaws that can expose data
USN-9005-1 covers remote authentication failures in 2D and Networking, including CVE-2026-91415 and CVE-2026-83395.
Ubuntu fixes Fetchmail denial-of-service flaws in USN-9013-1
Two named issues can crash Fetchmail on Ubuntu 16.04, 18.04 and 20.04 LTS; the notice snippet cuts off a third finding.
pyasn1 parsing bugs can exhaust CPU when decoding ASN.1
CVE-2026-59884 affects only Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS.
Canadian advisory covers IBM MQ and Watson Speech flaws
CVE-2026-11724 allows arbitrary code execution in MQ file transfer; CVE-2026-17493 can cause a denial of service.
libnfs ZDR decoding flaw can crash the library or run code
Ubuntu says missing maximum-size enforcement during ZDR decoding causes an out-of-bounds write in libnfs.
Ubuntu USN-9007-1: FreeRDP flaws can leak data or run code
The notice says the issues can also crash FreeRDP; the snippet lists no CVE ids or fixed versions.
Chatter Attack drives LLMs to responses up to 31.5 times longer
Prompts target short doubt-inducing phrases, and Bayesian Prompt Optimization extends the attack to black-box models.
Apache James before 3.9.1 allows denial of service upon MIME parsing
Upgrade to Apache James 3.9.1 or Mime4J 0.8.15 fixes the MIME parsing denial of service issue
Quest NetVault Backup StnzCreateKey flaw enables unauthenticated remote DoS
ZDI-26-888 is a numeric truncation error, CVE-2026-13269, scored CVSS 7.5 with no fix named.
GhostMap Android flaw lets installed app force a boot loop
Bitdefender’s no-permission demo crashed a Pixel 10 on Android 17; Google closed the report without a patch.
Ubuntu extends nginx security fixes to older LTS releases (USN-8955-2)
The notice also fixes CVE-2026-42533, which can let a remote attacker crash nginx or possibly run code.
Ubuntu fixes HAProxy regression on 22.04 after security update
The earlier fix for truncated HTTP/2 PING handling could exhaust CPU; the follow-up corrects a chunked-request regression.