CVE-2026-107387 music-metadata: Uncontrolled memory allocation in APEv2 parser

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file ca...

CVE-2026-107387 music-metadata: Uncontrolled memory allocation in APEv2 parser

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file ca...

EUVD-2026-94995

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

CVE-2026-14507 IBM DataPower Gateway Out-of-bounds Write

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

CVE-2026-14507

IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 are vulnerable to an out-of-bounds write (CWE-787) caused by improper memory allocation during key derivation. A remote authenticated attacker can exploit this flaw to cause a denial of service (DoS). IBM addresses this vulnerability in ver...

CVE-2026-93019

A signed integer conversion flaw was found in the Perl Imager library's TGA file reader. The colourmaplength field in the TGA header is declared as a signed short int. A TGA file with a colour map length of 32768 or greater causes the value to become negative, which sign-extends to a value near...

Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3

Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...

CLEANSTART-2026-NG64377 Unbounded memory allocation in Google Guava 11

Security vulnerability affects the apache-hive package. Unbounded memory allocation in Google Guava 11...

CLEANSTART-2026-OK35462 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the spark-sc213-jdk17-py312 package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

PT-2026-108006

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

PT-2026-108310

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description HTTP/2 servers are susceptible to excessive memory allocation when processing "Trailer" headers sent by a client. The server uses these header values to populate...

GHSA-GWG2-R3HJ-4W44 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

Summary A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present. In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from th...

ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

Summary A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present. In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from th...

Security update for rpcbind

This update for rpcbind fixes the following issues: CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch...

Formbook-Payload-Extraction-XOR-Decryption-Net-Assembly-Analysis

1. x32dbg – Encrypted Configuration Decryption & Memory Allocation The x32dbg memory dump reveals that Formbook decrypts its configuration data and allocates memory for it using NtAllocateVirtualMemory. Key Observations: NtAllocateVirtualMemory – Allocates memory for the decrypted payload. mov...

CVE-2026-106453

A flaw was found in lz4-java. The library trusts the decompressed length header in compressed input before validating the input data, leading to uncontrolled memory allocation. A remote attacker can exploit this vulnerability by supplying a specially crafted input that specifies an excessively...

CVE-2026-106450

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-102411

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used...

CVE-2026-103005 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an...