WordPress OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin < 6.3.11 - Unauthenticated DoS vulnerability

Unauthenticated DoS vulnerability discovered by Ángel Santana in WordPress Plugin OMGF | Host Google Fonts Locally versions 6.3.11...

EUVD-2026-91581

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-83663 Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-83663

Apache Thrift (versions before 0.25.0 ) contains an uncontrolled recursion vulnerability in its Go bindings . Specifically, both TFramedTransport and THeaderTransport incorrectly call Read recursively instead of using a loop when a frame yields no payload bytes. A remote attacker can trigger this...

Allocation of Resources Without Limits or Throttling

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in TFramedTransport.Read in lib/go/thrift/framedtransport.go and THeaderTransport.Read in...

AZL-106491 CVE-2026-82458 affecting package influxdb for versions less than 2.7.5-21

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

DEBIAN-CVE-2026-82458

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-105407 CVE-2026-82458 affecting package thrift 0.24.0-1

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106494 CVE-2026-82458 affecting package kata-containers 4.1.0.kata0-1

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-61373

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104428

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...

CVE-2026-104429

Zebra zebrad 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportiona...

CVE-2026-104434

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the zlistunifiedreceivers RPC handler, which calls expect on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an...

CVE-2026-104423

Zebra zebrad before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee...

CVE-2026-104426

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...

UBUNTU-CVE-2026-82458

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

EUVD-2026-91580

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

CVE-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...