The vulnerability of the rewrite mechanism (RewriteValve) of the Apache Tomcat application server allows a hacker to circumvent access control restrictions.

The vulnerability of the rewrite mechanism RewriteValve in the Apache Tomcat application server is related to the implementation of incorrect flow control. Exploiting this vulnerability allows a malicious actor to circumvent access control restrictions...

CVE-2026-66761

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

EUVD-2026-55879

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and...

CVE-2026-66761

CVE-2026-66761: SAP Approuter in SAP Business AI Platform suffers from insufficient flow control allowing a low-privilege attacker to send large volumes of data, leading to unbounded memory growth and low availability impact. No impact on confidentiality or integrity is claimed. CVSS 3.1 base sco...

PT-2026-70039

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to enforce sufficient flow control in certain functionality. A low-privileged attacker can send high volumes of data without consuming responses, leading to unbounde...

Vulnerability of JavaScript components: Firefox’s WebAssembly browser allows attackers to access sensitive data and compromise its integrity

JavaScript component vulnerability: Firefox’s WebAssembly browser is vulnerable due to the implementation of incorrect flow control. Exploiting this vulnerability could allow a remote attacker to access sensitive data and compromise its integrity...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through improper enforcement of the session flow control process. An attacker can cause resource exhaustion by sending dat...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the session flow control process. An attacker can cause resource exhaustion by sending messages that exceed the allowed incoming window. Remediation Upgrade Apache.Qpid.Proton to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the session flow control process. An attacker can exhaust available resources by sending data that causes the incoming window to be exceeded, resulting in service disruption...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the AMQP 1.0 session flow control handling in the Session10 and related transfer-processing code. An authenticated attacker can exhaust the session incoming window by sending ...

CVE-2026-68075

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-67553

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

UBUNTU-CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67591 Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67591

An authenticated attacker can exploit a flaw in Apache Qpid ProtonJ2 (versions through 1.1.0 ) by exceeding the session flow control incoming window . This vulnerability can lead to a denial of service (DoS) , rendering the system unavailable to legitimate users. To remediate this issue, users ar...

CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...