CLSA-2026-1790611493 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 1.17.3-tuxcare.2...

CLSA-2026-1790611463 TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 1.24.0-tuxcare.2...

CLSA-2026-1790609840 TuxCare security update for nanoid (4 CVEs)

TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2...

CLSA-2026-1790609063 TuxCare security update for multer (1 CVE)

TuxCare rebuilt multer to address 1 CVE. Fixed in 1.4.5-lts.2-tuxcare.6...

CLSA-2026-1790606671 TuxCare security update for devalue (2 CVEs)

TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.1-tuxcare.2...

CLSA-2026-1790605435 TuxCare security update for devalue (2 CVEs)

TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.0-tuxcare.2...

CLSA-2026-1790602996 TuxCare security update for log4j:log4j (1 CVE)

TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.12-tuxcare.2...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to an allocation leak in HTTP/2 backlog tracking when streams are reset, which allows a remote attacker to repeatedly reset streams and consume server resources, potentially causing denial of service...

CLSA-2026-1790597988 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.3.0-tuxcare.2...

CVE-2026-91043

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's maxheaderlistsize setting only on the compressed size of an inbound header...

CVE-2026-92103

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

CLSA-2026-1790597695 TuxCare security update for hono (12 CVEs)

TuxCare rebuilt hono to address 12 CVEs. Fixed in 3.12.12-tuxcare.2...

EUVD-2026-88219

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...

EEF-CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex...

CVE-2026-92103

The elixir-mint mint library (versions 0.1.0 to 1.11.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling issue. The root cause is located in Mint.HTTP2.Frame.decode_next/2 within lib/mint/http2/frame.ex, where the software only compares the frame size against the max_fram...

CVE-2026-91043

The elixir-mint mint HTTP client (versions 1.1.0 before 1.11.0 ) is vulnerable to a denial of service via memory exhaustion. The root cause is that Mint.HTTP2 only enforces the max_header_list_size on the compressed size of inbound header blocks, rather than the decoded list size as required by R...

CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's maxheaderlistsize setting only on the compressed size of an inbound header...