Security Bulletin:Jackson-Databind Denial-of-Service Vulnerability in Versions 2.13.0 to 2.14.0

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as...

Security Bulletin: As a Spring Framework applications, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-59282)

Summary Spring framework is used by IBM Sterling Control Center as part of dependency in spring-beans-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-59282 DESCRIPTION: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target...

BIT-ELASTICSEARCH-2026-94408 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

Elasticsearch 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.4 DoS (ESA-2026-176)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-176 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...

Elasticsearch 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.3 DoS (ESA-2026-170)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-170 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...

Elasticsearch 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.4 DoS (ESA-2026-180)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-180 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead deni...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-14507 DESCRIPTION: IBM DataPower Gateway could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

CVE-2026-94397

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

CVE-2026-94398

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

AZL-104942 CVE-2026-94408 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

CVE-2026-82294

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

AZL-104948 CVE-2026-82294 affecting package rubygem-elasticsearch 8.9.0-1

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CVE-2026-82300

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CVE-2026-94408 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a Denial of Service vulnerability in ws (CVE-2026-48779)

Summary A Denial of Service vulnerability in the ws WebSocket library CVE-2026-48779 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 8.21.1. Vulnerability Details CVEID:CVE-2026-48779 DESCRIPTION: ws is an open source WebSocket client and serve...

Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions fr...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: Fixes should be back-ported to all maintained versions unless there is a...

Elasticsearch 9.4.7, 9.5.4 Security Update (ESA-2026-182)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: Fixes should be back-ported to all maintained versions unless there is a...

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-181)

Uncontrolled Resource Consumption in Kibana Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: Fixes should be back-ported to all maintained versions unless there is a justified reason...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-180)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: Fixes should be back-ported to all maintained versions unless there is a...