96645 matches found
CLEANSTART-2026-PA36556 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources
Security vulnerability affects the containerd package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...
CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service
Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...
CLEANSTART-2026-LI38180 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
Security vulnerability affects the containerd package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...
CLEANSTART-2026-DE50350 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
Security vulnerability affects the containerd package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...
CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...
CVE-2026-102990
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...
CVE-2026-102990
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...
CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...
CLEANSTART-2025-ST85629 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service...
CLEANSTART-2025-JL64950 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...
CLEANSTART-2026-OH69104 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened
Security vulnerability affects the coredns package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...
CLEANSTART-2026-DV62893 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input
Security vulnerability affects the buildkitd package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input...
EUVD-2026-90254
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...
CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...
CVE-2026-93126
A flaw was found in the Linux kernel's remoteproc subsystem, specifically within the qcomq6v5adsp driver. When the adspmapcarveout function is called, it fails to properly release a device node reference. This oversight can lead to a reference leak, potentially causing resource exhaustion over ti...
CVE-2026-90178
A flaw was found in the Linux kernel's hwmon coretemp module. On systems with CPUs that do not support X86FEATUREPTS, the coredata array, which is allocated to manage temperature data, is not properly released. This memory leak can occur when the coretemp module is loaded and unloaded, potentiall...
CVE-2026-90361
A flaw was found in the Linux kernel's ath11k Wi-Fi driver. During the ath11kservicereadyextevent processing, a memory allocation for svcrdyext.macphycaps is not released if an error occurs during TLV Type-Length-Value parsing. This can lead to a memory leak, potentially causing resource exhausti...
CVE-2026-47505
A flaw was found in nvidia-driver. A local user can exploit a use-after-free condition in the kernel mode layer, which occurs when memory is improperly accessed after it has been released. A successful exploit could allow an attacker to achieve arbitrary code execution, privilege escalation, Deni...
CVE-2026-47491
A flaw was found in nvidia-driver. A local unprivileged attacker can trigger the improper release of memory resources in the kernel mode layer, leaving a memory mapping accessible after the underlying memory is reused. A successful exploit could allow an attacker to achieve privilege escalation,...
CVE-2026-103471
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...