PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

CVE-2026-102504

A flaw was found in Imager. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying an out-of-range channel count parameter when reading raw image files. The application attempts an excessive memory allocation without validating the input, causing an unhandled allocati...

Inefficient Algorithmic Complexity

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...

Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

CVE-2026-102504

Imager versions before 1.037 for Perl are vulnerable to a Denial of Service (DoS) condition in the i_readraw_wiol function. The software fails to perform range checks on the raw_datachannels value, allowing a negative or excessively large count to trigger an excessive memory allocation . When thi...

BIT-RABBITMQ-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CLEANSTART-2024-PW00833 PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0

Security vulnerability affects the exiv2 package. A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0...

Denial-Of-Service (DoS)

Apache Qpid Proton-J is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation and potentially cause a denial of service...

thrift: thrift: Denial of Service via excessive memory allocation

A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1785422875)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785422875 advisory. - A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-re...

CVE-2026-102504: Memory Allocation with Excessive Size Value

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range rawdatachannels value in ireadrawwiol. Nothing range-checks rawdatachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large coun...

Rocky Linux 8 [CIQ] Security Update: mingw32-expat / mingw32-expat-debuginfo / mingw64-expat / etc (crlsa-2025_21974)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521974 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 Tenable has...

The vulnerability of the parse_report_descriptor() function in the Wireshark USB HID traffic analyzer allows a hacker to cause a service failure.

The vulnerability of the parsereportdescriptor function in the Wireshark USB HID traffic analyzer relates to improper management of sequential memory allocation. Exploiting this vulnerability can allow attackers to cause service failures...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2024_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243253 advisory. libvirt: negative gnew0 length can lead to unbounded memory allocation CVE-2024-2494 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector (crlsa-2025_3411)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20253411 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...

Rocky Linux 8 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7012)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227012 advisory. OpenJDK: improper MultiByte conversion can lead to buffer overflow JGSS, 8286077 CVE-2022-21618 OpenJDK: excessive memory allocation in X.509 certificate...

CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS7:CLSA-2026:1786355721)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786355721 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory...

Rocky Linux 10.0 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_19403)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202519403 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 Tenable...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_21776)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521776 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 Tenable has...