Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket reader aiohttp/websocket/readerpy.py accumulating an unbounded number of per-read payload fragments in memory. An attacker can send a large number of tiny WebSocket...

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...

GHSA-4WC5-F2RC-Q74M russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...

firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Storage: Quota Manager component...

firefox: thunderbird: Uninitialized memory in the Audio/Video component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video component...

CVE-2026-10743

An authenticated attacker can cause a denial of service or corrupt memory in IBM MQ due to a race condition (CWE-1223). The vulnerability stems from improper validation of buffer sizes during MQOPEN operations . No specific remediation or exploit details are provided in the documents.

CVE-2026-10743 IBM MQ Race Condition

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

EUVD-2026-104474

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

CVE-2026-11831

IBM MQ is vulnerable to a heap-based buffer overflow (CWE-122) occurring during the processing of a specially crafted client request. An authenticated attacker can leverage this out-of-bounds read to cause a limited denial of service and gain very limited information regarding the process memory ...

EUVD-2026-104471

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request...

CVE-2026-11831 IBM MQ Heap-based Buffer Overflow

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request...

OPENSUSE-SU-2026:22135-1 Security update for coredns

This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport boo1279216 Done through the gomodules "require" parameter in servi...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061

The russh Rust SSH client and server library contains a vulnerability in its SSH agent protocol implementation prior to version 0.64.1 . The agent server improperly handles SSH_AGENT_CONSTRAIN_LIFETIME records by spawning a separate long-lived task for every record in a constrained add-key reques...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

EUVD-2026-104457

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

firefox: thunderbird: Uninitialized memory in the Audio/Video component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video component...

firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Storage: Quota Manager component...