CVE-2026-93488: Allocation of Resources Without Limits or Throttling

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

CVE-2026-93309 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93309

CVE-2026-93309 affects the VES Collector component of O-RAN-SC SMO OAM (version 2025-06-10). The vulnerability involves uncontrolled resource allocation within an unspecified functionality of the collector, allowing a remote attacker with low privileges to trigger a partial availability impact. C...

CVE-2026-93309 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93308 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-93308 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM (2025-06-10). The vulnerability allows a remote, low-privilege attacker to trigger an allocation of resources issue, resulting in a low availability impact (CVSS 3.1 base score: 4.3 – MEDIUM ). The specific functionality affec...

CVE-2026-93307

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to...

CVE-2026-93307

CVE-2026-93307 affects the VES Collector component in O-RAN-SC SMO OAM (version 2025-06-10). The vulnerability stems from manipulation of the additionalFields.padding argument, which leads to uncontrolled memory allocation . An attacker with low privileges can exploit this remotely , resulting in...

CVE-2026-93307 O-RAN-SC SMO OAM VES Collector memory allocation

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to...

grafana: Grafana Live: Denial of Service due to unbounded memory allocation via push endpoint

A flaw was found in Grafana Live. An authenticated user with access to the Grafana Live API can exploit the push endpoint by sending a large or streaming request body. This can lead to unbounded memory allocation, potentially causing out-of-memory conditions and resulting in a Denial of Service D...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

grafana: Grafana Live: Denial of Service due to unbounded memory allocation via push endpoint

A flaw was found in Grafana Live. An authenticated user with access to the Grafana Live API can exploit the push endpoint by sending a large or streaming request body. This can lead to unbounded memory allocation, potentially causing out-of-memory conditions and resulting in a Denial of Service D...

Security Bulletin: Vulnerability in @opentelemetry/core affects DB2 Dev Extension (CVE-2026-54285)

Summary Upgraded @opentelemetry/core to 2.8.0. Vulnerability Details CVEID:CVE-2026-54285 DESCRIPTION: opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP header...

FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing

A flaw was found in FreeRDP. A remote attacker can exploit a vulnerability in the Remote Desktop Protocol RDP Enhanced Input RDPEI server channel handler. By sending a malicious RDPEI message with an oversized declared body length, the attacker can force the server to allocate excessive memory,...

CVE-2026-93176

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-93172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

CVE-2026-93118

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

AZL-102150 CVE-2026-93118 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...