EUVD-2026-104304

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncakesessionid values and large nested-buffer...

CVE-2026-111384

Nezha version 1.0.0 before 2.3.15 is vulnerable to a memory exhaustion flaw within the dashboard file manager WebSocket endpoint. The root cause is that fmStream fails to call SetReadLimit , allowing for unbounded message sizes. An authenticated user with file manager scopes can trigger an OOM ki...

EUVD-2026-102565

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:i...

ingress-nginx

Ingress NGINX Retirement Retiring What You Need to Know about Ingress NGINX Retirement: Best-effort maintenance will continue until March 2026. Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered. Existing...

CVE-2026-32941

A framework-wide vulnerability in Sliver C2 allows for an unauthenticated, remote Denial of Service by triggering Uncontrolled Memory Allocation CWE-789 / CWE-400, leading to a process-wide Out-of-Memory OOM crash. References: Tenable Reproduction Steps: 1. Extract Credentials: Obtain the mTLS...

CVE-2026-96299

The MongoDB Server is vulnerable to a memory exhaustion (OOM ) condition due to missing resource limits in the match expression evaluator . The flaw allows an authenticated user with read-only privileges to execute an aggregation query using nested internal schema validation operators (intended f...

CVE-2026-74030

Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2jsonnode that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd o...

CVE-2026-109310

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

EUVD-2026-97612

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

Amazon Linux 2 : fence-agents (ALAS-2026-3988)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3988 advisory. httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in...

CVE-2026-109310: Allocation of Resources Without Limits or Throttling

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

Medium: fence-agents

Issue Overview: httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server t...

CVE-2026-107840

The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...

BIT-APISIX-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

Oracle Linux 8 : pki-core:10.6 (ELSA-2026-75573)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-75573 advisory. - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 - RHEL-245455 CVE-2026-76561 pki-core:...

PT-2026-109285

Name of the Vulnerable Software and Affected Versions ageLANServer versions prior to 1.15.2 Description The bundled game server in ageLANServer contains a remote denial-of-service issue. The POST /game/cloud/getFileURL endpoint fails to limit the request body size or the number of elements in the...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

CVE-2026-5769: Cleartext Storage in a File or on Disk

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...