GO-RPCBOMB

Description: CVE-2017-8779 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service memory consumption with ...

CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer 4.8.1 via Monolog - Denial of Service DoS After months of waiting for a response from MITRE, I obtained CVE-2025-43960 with a PHP Object Injection attack against the Adminer service 4.8.1, causing a Denial of Service DoS through Memory Manipulation...

CVE-2017-7472

CVE-2017-7472 The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service memory consumption via a series of KEYREQKEYDEFLTHREADKEYRING keyctlsetreqkeykeyring calls. Shortcut Vulnerable kernel 4.10.13...

CVE-2026-128128

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the...

CVE-2026-128129

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

EUVD-2026-125761

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128129 AIOHTTP: Unbounded buffering of data received during an upgrade request

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128129

The AIOHTTP asynchronous HTTP client/server framework for Python is vulnerable to unbounded memory consumption in versions prior to 3.14.4 . The root cause is that the framework buffers additional connection data during an upgrade request (such as a WebSocket handshake) without implementing a siz...

CVE-2026-128129 AIOHTTP: Unbounded buffering of data received during an upgrade request

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can...

CVE-2026-128128 AIOHTTP: WebSocket max_msg_size bypass via integer overflow

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader adds a declared frame length to the size of an already buffered partial message using signed 64-bit arithmetic. A length near two to the power of 63 can overflow, allowing the...

CVE-2026-128128

The AIOHTTP asynchronous HTTP framework is vulnerable to an integer overflow in its C WebSocket reader prior to version 3.14.4 . The vulnerability occurs because the reader uses signed 64-bit arithmetic to add a declared frame length to a buffered partial message. A length near $2^{63}$ can cause...

CVE-2026-128125 AIOHTTP: Unbounded cookie storage in client CookieJar

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

CVE-2026-128125 AIOHTTP: Unbounded cookie storage in client CookieJar

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

CVE-2026-128125

The aiohttp asynchronous HTTP framework for Python and asyncio is vulnerable to unbounded cookie storage in the client CookieJar prior to version 3.14.4 . The root cause is that Set-Cookie parsing treats unrecognized name=value attributes as additional cookies without limitations on the number of...

CVE-2026-126396

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

CVE-2026-126396

The vLLM library (versions 0.24.0 to before 0.31.0 ) is vulnerable to a resource exhaustion issue within the MiniMax M3 VL video processor . The root cause is the lack of range validation or min_pixels

EUVD-2026-125169

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

CVE-2026-126396 vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

CVE-2026-126396 vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels

vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level minpixels without range or minpixels = maxpixels validation. Its video-wide pixel budget is enforced only when maxlongsidepixel is set, and that value...

CVE-2026-126407

The Wasmtime runtime is vulnerable to a Denial of Service (DoS) attack in versions before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1. The root cause is that the engine allocates untracked host memory when a component receives a borrow of a resource it defined it...