EUVD-2026-111387

russh's SSH agent server is susceptible to unbound allocations via repeated SSHAGENTCONSTRAINCONFIRM messages...

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. Concretely, the evidence comes from executing the real russh v0.64.1 client...

Linux Distros Unpatched Vulnerability : CVE-2026-119134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not...

Moderate: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

EUVD-2026-113201

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134

The Wasmtime runtime is vulnerable to unbounded host memory growth in versions before 36.0.18 , 37.0.0 before 48.0.6 , and 49.0.0 before 49.0.3 . The root cause is that the runtime caps component-model resource handle tables only per component instance without charging handle allocations to any R...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119286: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

PT-2026-132854

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.3.0a3 through 3.3.0 Description The validate function reuses a module-level ValidationAbortedError when a document exceeds the max errors threshold. Because Python appends frames to the reused exception's traceback duri...

PT-2026-132365

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables…

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

Linux Distros Unpatched Vulnerability : CVE-2026-116696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in...

DEBIAN-CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...

UBUNTU-CVE-2026-116696

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSHAGENTCONSTRAINCONFIRM records while adding a key and appends every Constraint::Confirm record ...