Mattermost resource management error vulnerability

Versions 11.9.1 and earlier of Mattermost, as well as versions 11.8.5 and earlier, 11.7.10 and earlier, and 11.10.1 and earlier are affected by a resource management error vulnerability. This vulnerability arises because the WebSocket msgpack decoder fails to enforce allocation limits on byte...

Mattermost resource management error vulnerability

Mattermost versions 11.9.1 and earlier within the 11.9.x series, 11.8.5 and earlier within the 11.8.x series, 11.7.10 and earlier within the 11.7.x series, and 11.10.1 and earlier within the 11.10.x series contain a resource management error vulnerability. This vulnerability arises from the lack ...

Andrew Bennett JOSE Resource Management error vulnerability

In versions 1.5.0 through 1.11.13 of JOSE, there is a resource management error vulnerability. This vulnerability arises because the JOSEjwk:sharedsecret/2 function, when receiving a JWK with a different key type, calls itself repeatedly with the same parameters, resulting in an unbounded tail...

Christian Garbs gbsplay buffer error vulnerability

Versions 0.0.103 and earlier of Christian Garbs’ gbsplay contain a buffer error vulnerability. This vulnerability stems from the gbropen function in gbs.c failing to validate file length prior to scanning the GBR ROM title field. As a result, it may lead to heap-based out-of-bounds reads. Attacke...

Asterisk resource management error vulnerability

Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3, contain a resource management error vulnerability. This vulnerability arises when an authenticated attacker sends a SIP INVITE over a connection-oriented...

FastStone Image Viewer buffer error vulnerability

FastStone Image Viewer versions 8.5 and earlier contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds read issue in the FUN0062d96c function within the Box-Average Downsampler Engine component, allowing remote attackers to exploit it...

CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...

EUVD-2026-109562

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the...

CVE-2026-116180

A flaw was found in vLLM. A remote client sharing the inference engine can trigger a Denial of Service DoS by submitting requests with prompt log probabilities enabled against a cached prefix. Because uninitialized memory is allocated for log probability tensors, cached token positions remain...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from a lack of cleanup when using the -set profile option, potentially leading to memory leaks, resource exhaustion, and even a denial of service...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the UHDR decoder performs range checks only after decoding, allowing attackers to bypass image size restrictions and deliver specially crafted ultra-large UHDR images,...

Parse Platform Parse Server input validation error vulnerability

Versions prior to Parse Platform Parse Server 8.6.100 and versions from 9.0.0 through 9.10.4-alpha.3 contain an input validation error vulnerability. This vulnerability arises from the failure to reject writes to reserved internal field names within client objects; as a result, clients can store ...

Brain ADM-ZIP for NodeJS processing logic error vulnerability

The Brain ADM-ZIP for NodeJS versions 0.6.1 and earlier contain a logic error vulnerability stemming from improper validation of repeated entries. This flaw allows attackers to bypass readEntries checks by using valid equivalent entry names. They can then craft a ZIP archive such that getEntry or...

smg-project Shepherd Model Gateway resource management error vulnerability

Versions 1.7.0, 1.8.0, 1.9.0, 1.10.0, and 1.10.1 of the smg-project Shepherd Model Gateway contain a resource management error vulnerability. This vulnerability arises from improper memory allocation caused by operations on the jpegturbo::decodejpegrgb function within the file...

Edgeless Systems contrast input validation error vulnerability

Edgeless Systems version 1.21.0 prior to 1.25.0 contains an input validation error vulnerability. This flaw stems from an indeterministic flaw in registry selection within imagepuller; it prioritizes matching wildcard configuration values over specific domain names. As a result, registry...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from improper input validation in the Rust gRPC converter. Remote attackers can exploit CandidateTokens.topn to bypass the maxlogprobs limit by sending Generate or GenerateStream requests containi...

Rclone input validation error vulnerability

Versions of Rclone from 1.52.0 through 1.75.2 contain an input validation error vulnerability. This vulnerability stems from the pCloud backend’s failure to verify the localhost OAuth callback status and trusting the hostname parameter. It makes the system susceptible to cross-site request forger...

vLLM resource management error vulnerability

Versions vLLM from 0.18.0 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because the API client can bypass the maximum number of video/JPEG frames by using mediaiokwargs to set numframes to -1 and uploading large inline videos. As a...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792140497)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792140497 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a...

ImageMagick processing logic error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-32 contain a logic error vulnerability stemming from an incomplete fix for policy bypass issues. This allows security policy bypass, enabling attackers to circumvent configuration restrictions that would otherwise prevent certain...