BIT-THRIFT-2026-94638 Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-106435

A flaw was found in pymongo. An attacker who can supply crafted BSON Binary JSON data to the application's decoding functions can trigger an out-of-bounds read when parsing a truncated regular expression missing a terminating null byte. This flaw can cause the application process to terminate...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

PT-2026-108198

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description The binary accelerator in the driver can perform an out-of-bounds read when decoding malformed BSON that contains a truncated regular-expression element missing a trailing NUL...

EUVD-2026-91800

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction...

GHSA-54P9-H82J-F925 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

Linux Distros Unpatched Vulnerability : CVE-2026-104874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items,...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

UBUNTU-CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

A flaw was found in multidict. The multidict C extension fails to release object references during certain items-view union and subtraction operations. An attacker could exploit this vulnerability by supplying crafted input sequences to applications performing these operations, triggering...

CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

The Multidict library (versions 6.7.0 through 6.9.1 ) contains a memory leak vulnerability within its C extension . Specifically, the multidict_itemsview_or2_impl and multidict_itemsview_sub1_impl functions fail to release new key-identity and value references during reflected union (operand | d....

CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

CVE-2026-104874 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items, in multidictitemsviewor2impl and subtraction operation, d.items - operand, in multidictitemsviewsub1impl fail to release new key-identit...

MGASA-2026-0467 Updated python-tornado packages fix security vulnerabilities

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit gzip bomb...