CVE-2025-11626
MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
CVSS
5.5
Medium
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Oct 10, 2025 · Last modified: Oct 19, 2026 · CWE-835
0.1%EPSS · 30 days0.1%
2026-09-262026-10-23
MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1157744.9 MED—
——0Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.2dCVE-2026-66281—11.8%
——4In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.2dCVE-2026-1103547.5 HIG54.9%
——16HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.3dCVE-2026-96642—25.4%
——8Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.3dCVE-2026-764455.3 MED34.8%
——10Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.3dCVE-2026-200195.8 MED34.8%
——10Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when Snort 3 parses UDP Netflow Protocol packets. An attacker could exploit this vulnerability by sending a single crafted Netflow packet through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.3d