High, CVSS 8.9
Crass : Large numeric exponents cause CPU and memory denial of service
RubyGems crass · Upgrade to 1.0.7 or later · < 1.0.7 · CVE-2026-61845 · GHSA-6wmf-3r64-vcwv · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.0
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
crates.io pingora-proxy · Upgrade to 0.9.0 or later · >= 0.0.0-0, < 0.9.0 · CVE-2026-105299 · GHSA-vx4q-2c55-cvmg
- High, CVSS 7.5
Unbounded tool schema cache in Streamable HTTP server transport
crates.io rmcp · Upgrade to 3.6.0 or later · >= 3.0.0, < 3.6.0 · GHSA-4432-vg92-fqh6
- High, CVSS 8.7
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
crates.io pingora-core · Upgrade to 0.8.1 or later · >= 0.0.0-0, < 0.8.1 · CVE-2026-105297 · GHSA-7gpj-mj4q-x62x
A vendor fix does not resolve your finding until you verify it in your own systems.