GHSA-334F-VVP4-7G6P Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this...

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the MessageBuffer.ResendAsync process. An attacker can cause indefinite blocking of broadcasts and resource exhaustion by exploiting backpressure mechanisms in stateful reconnect...

EUVD-2026-81261

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full...

Linux Distros Unpatched Vulnerability : CVE-2026-81872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CP...

CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BatchingProcessor. An attacker can exhaust CPU resources and degrade or deny service by continuously filling the asynchronous export buffer while the exporter is backpressured...

AZL-103058 CVE-2026-81872 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-69202

Http4s is a Scala HTTP services library. In versions prior to 0.23.35 and 1.0.0-M47 , Ember's HTTP/2 flow-control window is replenished based on bytes received from the network rather than bytes consumed by the application, and each stream stores DATA in an unbounded channel . A remote peer can t...

CVE-2026-69213

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...

CVE-2026-69213 Http4s Ember HTTP/2: unbounded outbound frame queue

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...

CVE-2026-69213

Http4s is a Scala interface for HTTP services. The vulnerability lies in Ember HTTP/2 , which serializes outbound frames through a single unbounded queue consumed by writeLoop. When a peer stops reading, an unauthenticated HTTP/2 client can keep sending PING, SETTINGS, or DATA frames , causing Em...

EUVD-2026-79183

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...

CVE-2026-69213: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause...

Denial-of-Service (DoS)

Reactor Core is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of backpressure when the Flux.bufferTimeout operator is used with fair backpressure enabled, which allows an attacker to trigger excessive resource consumption and potentially exhaust application...

CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-47863

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47857

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

CVE-2026-47857 Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...