CVE-2026-108260

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Tina

Products

Tinacms Web-components

CVE-2026-104633

Gitea migration memory exhaustion from zero page size

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-98347

IB/IPoIB: Avoid restoring OPER_UP after multicast flush

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to prevent multicast joins while ipoib_mcast_dev_flush() is running, and restores the flag afterwards if it was previously set. This restore races with ipoib_ib_dev_down(). If the interface is brought down while the flush is in progress, ipoib_ib_dev_down() clears IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device has already gone down. Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP being cleared to terminate its rtnl_trylock() retry loop. If the flag is left set after shutdown, the workqueue retries forever, causing teardown to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while holding RTNL. Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag. Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast joins are allowed, avoiding the race with device shutdown.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-98237

net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-106121

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Com.rabbitmq Rabbitmq Vmware

Products

Amqp-client Java-client Rabbitmq Java Client

CVE-2026-107696

FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-106164

Infinite Loop in Telerik Document Processing XLS Import

In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Telerik Document Processing Libraries

CVE-2026-107577

Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progressive Robot

Products

Hmailserver

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed

Vendors

Apache Netapp Oracle and 1 more

Products

Xerces-j Active Iq Unified Manager Agile Engineering Data Management and 28 more

CVE-2021-41079

Apache Tomcat DoS with unexpected TLS packet

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 7.2% KEV · Not listed

Vendors

Apache Debian Netapp and 1 more

Products

Tomcat Debian Linux Management Services For Element Software And Netapp Hci and 3 more

CVE-2018-7167

nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Rhel Software Collections

CVE-2021-37714

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Jsoup Netapp Oracle and 2 more

Products

Jsoup Management Services For Element Software And Netapp Hci Banking Trade Finance and 22 more

CVE-2020-13935

tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CVSS 3.1 · 7.5 High EPSS 86.6% KEV · Not listed

Vendors

Apache Canonical Debian and 5 more

Products

Tomcat Ubuntu Linux Debian Linux and 20 more

CVE-2017-9233

expat: Inifinite loop due to invalid XML in external entity

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

CVSS 3.1 · 7.5 High EPSS 8.7% KEV · Not listed

Vendors

Debian Libexpat Project Python

Products

Debian Linux Libexpat Python

CVE-2026-103885

Apache Directory LDAP API: Denial of service via crafted telephone number values

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Directory Ldap Api

CVE-2026-95386

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-96418

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2021-39140

XStream can cause a Denial of Service

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS 3.1 · 6.5 Medium EPSS 5.9% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Snapmanager and 18 more

CVE-2022-36313

file-type: a malformed MKV file could cause the file type detector to get caught in an infinite loop

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Sindresorhus

Products

Jboss Data Grid File-type

CVE-2014-0050

apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

CVSS 3.1 · 7.5 High EPSS 83.3% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Commons Fileupload Tomcat Retail Applications and 13 more