3330 matches found
OESA-2026-3681 nmap security update
Nmap "Network Mapper" is a free and open source license utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts. Security Fixes: Nmap versions up to and including 7.99 contains a denial of service vulnerability tha...
OESA-2026-3680 nmap security update
Nmap "Network Mapper" is a free and open source license utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts. Security Fixes: Nmap versions up to and including 7.99 contains a denial of service vulnerability tha...
OESA-2026-3679 nmap security update
Nmap "Network Mapper" is a free and open source license utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts. Security Fixes: Nmap versions up to and including 7.99 contains a denial of service vulnerability tha...
SUSE CVE-2026-55497
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded...
SUSE CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...
EUVD-2026-56926
ffuf denial of service OOM via HTTP response decompression bomb...
GHSA-JCVH-XF52-2CWM ffuf denial of service (OOM) via HTTP response decompression bomb
Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...
grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates
A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...
SUSE CVE-2026-84304
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
Linux Distros Unpatched Vulnerability : CVE-2026-84382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip,...
GO-2026-6325 Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo
Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo...
CVE-2026-84382 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...
RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Service Management Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 a...
PT-2026-84849
Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.12.0 Description Content decoders in src/httpx2/httpx2/ decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before the iter bytes or aiter bytes functions yield bounded pieces to the application...
CVE-2026-84382: Improper Handling of Highly Compressed Data (Data Amplification)
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...
AZL-99258 CVE-2026-84304 affecting package kubevirt 1.8.4-2
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
AZL-99119 CVE-2026-84304 affecting package buildah 1.43.1-3
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Vulnerability Details File: index.js Location: cache browserslist's result cache, line 402 and parseCache parseQueries's AST cache Root Cause js var cache = var parseCache = function browserslistqueries, opts ... var cacheKey = JSON.stringifyqueries, context if cachecacheKey return cachecacheKey...