CVE-2026-81693

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81692

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

EUVD-2026-67070

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter found in identity file protection blocks. Because the value is passed unboundedly into Argon2 key derivation, an attacker with write access to local identity stores can craft a malicious identity file with an excessive memor...

CVE-2026-81720 openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693

openssl_encrypt before 1.4.9 is vulnerable to a denial-of-service condition caused by insufficient validation of the total field in QR JSON payloads. An attacker can supply a crafted QR image with an extremely large total value, triggering unbounded memory allocation that leads to an out-of-memor...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

EUVD-2026-67048

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-81692 openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

polkit: Polkit: Denial of Service via unbounded input processing through standard input

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input stdin. This unbounded input can lead to an out-of-memory OOM condition, resulting in a Denial of Service DoS for the...

CVE-2026-12600

Denial-of-service DoS vulnerability in the internal JPEG2000 JPX decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption...

CVE-2026-14682

A flaw was found in Bouncy Castle for Java, including its LTS and FIPS variants. This vulnerability allows a remote attacker to trigger an Out-Of-Memory OOM error by providing specially crafted input during a definite-length read operation. This unbounded memory allocation can lead to a Denial of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: Fixed a memory leak caused by LZMA global compressed deduplication. When testing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I discovered that some short-lived temporary...

Astra Linux – Vulnerability in Jetty9

Jetty is a Java-based web server and servlet engine. In affected versions, servlets that support multipart requests e.g., annotated with @MultipartConfig and call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause an OutOfMemoryError when the client sends a multipart request...