Inefficient Algorithmic Complexity

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...

Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

CVE-2026-102504

Imager versions before 1.037 for Perl are vulnerable to a Denial of Service (DoS) condition in the i_readraw_wiol function. The software fails to perform range checks on the raw_datachannels value, allowing a negative or excessively large count to trigger an excessive memory allocation . When thi...

BIT-RABBITMQ-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CLEANSTART-2024-PW00833 PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0

Security vulnerability affects the exiv2 package. A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0...

Denial-Of-Service (DoS)

Apache Qpid Proton-J is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation and potentially cause a denial of service...

thrift: thrift: Denial of Service via excessive memory allocation

A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1785422875)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785422875 advisory. - A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-re...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1790073266)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790073266 advisory. - A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-re...

CVE-2026-102504: Memory Allocation with Excessive Size Value

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range rawdatachannels value in ireadrawwiol. Nothing range-checks rawdatachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large coun...

Rocky Linux 8 [CIQ] Security Update: python-pillow-debuginfo / python3-pillow / python3-pillow-debuginfo / etc Multiple Vulnerabilities (crlsa-2021_4149)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214149 advisory. python-pillow: Out-of-bounds read in J2K image reader CVE-2021-25287 python-pillow: Out-of-bounds read in J2K image reader CVE-2021-25288 python-pillow:...

The vulnerability of the parse_report_descriptor() function in the Wireshark USB HID traffic analyzer allows a hacker to cause a service failure.

The vulnerability of the parsereportdescriptor function in the Wireshark USB HID traffic analyzer relates to improper management of sequential memory allocation. Exploiting this vulnerability can allow attackers to cause service failures...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.2:CLSA-2024:1718787931)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718787931 advisory. - A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature...

Rocky Linux 8 [CIQ] Security Update: tcpdump / tcpdump-debuginfo / tcpdump-debugsource (crlsa-2021_4236)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214236 advisory. tcpdump: ppp decapsulator can be convinced to allocate a large amount of memory CVE-2020-8037 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: libwebp / libwebp-debuginfo / libwebp-debugsource / libwebp-devel Multiple Vulnerabilities (crlsa-2021_4231)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214231 advisory. libwebp: out-of-bounds read in WebPMuxCreateInternal CVE-2018-25009 libwebp: out-of-bounds read in ApplyFilter CVE-2018-25010 libwebp: out-of-bounds read i...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_3344)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253344 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_54184)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654184 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2023_4570)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234570 advisory. iperf3: memory allocation hazard and crash CVE-2023-38403 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

CentOS Linux 8.4 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS8.4:CLSA-2026:1778172123)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1778172123 advisory. - Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker...