CVE-2026-72684

This CVE affects Elasticsearch where an authenticated user with read privileges can trigger memory allocation by sending a crafted small search input, leading to an out-of-memory fatal condition and node denial of service. Affected versions: 8.0.0–8.19.19 and 9.0.0–9.4.4. Mitigation: upgrade to v...

CVE-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

CVE-2026-72684

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

EUVD-2026-58248

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through DnsCodecUtil.decompressDomainName in codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java. An attacker can exhaust direct memory and trigger a gradual denial o...

gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-73565

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73561

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. Th...

gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2022-4994: KVM: x86: wean fast IN from emulatorpioin bsc1273097. CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2024-38542: RDMA/manaib:...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2022-4994: KVM: x86: wean fast IN from emulatorpioin bsc1273097. CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2026-46052: ceph: only dad...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73565

CVE-2026-73565 affects @hono/node-server

CVE-2026-73565 @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73565 @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-19113

A flaw was found in Consul. A remote, unauthenticated attacker could exploit several agent HTTP API endpoints by sending a request with an unbounded body. This could cause the agent to consume substantial memory, leading to a denial of service DoS condition...

CVE-2026-25589

A flaw was found in RedisBloom. An authenticated attacker with permission to execute the RESTORE command on a Redis server with the RedisBloom module loaded can supply a crafted serialized payload that causes an invalid memory access due to an improper validation of serialized values processed...

webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...