By weakness (CWE)

CWE-606: related vulnerabilities

CVEs classified under CWE-606. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-10143HIGH 7.5

  kafka-python versions before 2.3.2 contain a denial-of-service flaw in their SCRAM authentication mechanism. When connecting to a Kafka broker, the client accepts an iteration count from the broker without validation and passes it directly to a cryptographic hashing function. A malicious broker or attacker positioned between client and broker can send an extremely large iteration count, causing the client's event loop to freeze during authentication. This blocks all Kafka operations—producers cannot send messages, consumers cannot poll, admin commands fail, and heartbeats stop. Frozen clients are evicted from consumer groups and enter a cycle of reconnection failures, effectively denying service to applications relying on Kafka.

• CVE-2026-27145MEDIUM 6.5

  Go's x509 certificate verification function contained a performance flaw where hostname validation was inefficient. When checking if a certificate's DNS Subject Alternative Names matched the requested hostname, the code repeatedly split the hostname string for each SAN entry rather than doing this work once. This created a quadratic performance problem: the cost grew exponentially with both the number of DNS SANs in the certificate and the number of labels (dot-separated parts) in the hostname itself. An attacker could craft a certificate with an extremely large SAN list to cause verification delays. Worse, this overhead occurred even when validating untrusted certificates, before the certificate chain was properly validated, making denial-of-service attacks feasible.

• CVE-2026-33800MEDIUM 6.5

  Juniper Networks Junos OS on MX Series routers has a vulnerability that allows an attacker on the same network segment to crash the Forwarding Processing Card (FPC) by repeatedly triggering Micro-BFD session state changes. The vulnerability exploits the router's event processing queue, which becomes overwhelmed when sessions continuously flip between up and down states. This causes a watchdog timer to expire, forcing the FPC to crash and cutting off traffic. The attack requires network adjacency but no authentication, and affects specific hardware models in the MX lineup.

• CVE-2026-15172MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in how it processes FMP/NOTIFY protocol packets. When a user opens a specially crafted network capture file or views malicious traffic, the dissector (the component that parses the protocol) crashes, causing Wireshark to stop responding. This is a local denial-of-service issue affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker would need to deliver a malicious capture file or convince a user to analyze untrusted network traffic, but no special privileges are required on the target system.

• CVE-2026-41986LOW 2.4

  CVE-2026-41986 is a logic bypass vulnerability affecting file system operations. An attacker with physical access to a system could exploit this flaw to disrupt availability—for example, by manipulating file system behavior to cause denial of service. The vulnerability requires direct physical interaction with the machine and carries a low severity rating. The primary concern is operational disruption rather than data theft or system compromise.