https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:41:57 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-45820 <p>fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.</p> <p>fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-45820 https://vulnerability.circl.lu/vuln/ghsa-px8p-9vwx-vf98 <p><strong>Affected:</strong> npm: fflate</p> <p>fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.</p> <p><strong>Affected:</strong> npm: fflate</p> <p>fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.</p> https://vulnerability.circl.lu/vuln/ghsa-px8p-9vwx-vf98 https://vulnerability.circl.lu/vuln/rhsa-2026:68690 <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal fflate: fflate: Denial of Service via crafted ZIP archives net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing</p> <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal fflate: fflate: Denial of Service via crafted ZIP archives net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing</p> https://vulnerability.circl.lu/vuln/rhsa-2026:68690