CVE-2026-94640

A flaw in rpcbind allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) by sending a large volume of unique requests. The service stores unseen RPC statistics in unbounded in-memory lists , resulting in persistent memory growth and elevated CPU usage, which can exhaust se...

CVE-2026-77619

CVE-2026-77619 affects the logstash source in Vector (versions 0.15.0 through 0.57.0). The vulnerability stems from the source reading a 32-bit compressed-frame length from the network and sizing an in-memory buffer without an upper bound . An unauthenticated remote peer reaching the default 0.0....

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-81886 radare2: Uncontrolled memory allocation in radare2 dmp64 parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loo...

CVE-2026-81886 radare2: Uncontrolled memory allocation in radare2 dmp64 parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loo...

CVE-2026-81886

radare2 is a UNIX-like reverse engineering framework. Prior to 6.2.0 , its Windows 64-bit crash-dump (dmp64) parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop without validating the count against the actual dump size. Opening a small...

CVE-2026-81886 radare2: Uncontrolled memory allocation in radare2 dmp64 parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loo...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Memory Allocation, Improper Validation, Inadequate Encryption Strength, Inefficient Algorithmic Complexity and LDAP Injection.

Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcprov-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This iss...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

PT-2026-96792

Name of the Vulnerable Software and Affected Versions Vector versions 0.15.0 through 0.56.0 Description The logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer accessing the default...

ROS-20260922-73-0133

The vulnerability in Python-Django is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-96971

Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.17.4 Description An issue exists where the PSDImage.composite and PSDImage.numpy functions allocate output buffers based on geometry specified in the PSD header—including width, height, channels, depth, and...

CVE-2026-59991: Memory Allocation with Excessive Size Value

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-58268: Memory Allocation with Excessive Size Value

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python (UTSA-2026-090108)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090108 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacke...

SUSE CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

SUSE CVE-2026-93590

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...