Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in apstrcmpmatch, especially when an extremely large input buffer is used. Although no code distributed with the server can be forced to make such a call, third-party modules or Lua scripts that us...

CVE-2023-50965

💥 CVE-2023-50965 — 스택 버퍼 오버플로우 익스플로잇 Linux CVE-2023-50965 에 대한 개념 증명 익스플로잇으로, 스택 기반 버퍼 오버플로우를 시연하며, 익스플로잇 완화 조치가 활성화되지 않은 취약한 시스템에서 원격 코드 실행RCE으로 이어집니다. 이 프로젝트는 보안 연구 및 익스플로잇 개발 실습 을 위해 개발되었으며, Linux 환경에서의 메모리 손상 취약점과 고전적인 익스플로잇 기술을 이해하는 데 중점을 둡니다. 취약점 개요 CVE-2023-50965는 스택 버퍼 오버플로우 취약점 으로, 공격자가...

EUVD-2026-74281

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint...

AZL-100917 CVE-2026-83530 affecting package cloud-provider-kubevirt 0.5.1-7

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-100932 CVE-2026-83530 affecting package keda 2.14.1-18

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

CVE-2026-73196

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

EUVD-2026-63241

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

NIP-98 authorization parsing permits resource exhaustion

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

CVE-2026-51269

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

BIT-ELK-2026-42397 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-51269

...

EUVD-2026-46387

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397

Kibana is affected by CVE-2026-42397 through a vulnerability in Entity Analytics endpoints where authenticated users can submit oversized input, causing excessive resource consumption and potential denial of service (CWE-770; CAPEC-130). Affected versions include 9.x (9.3.0–9.3.6 and 9.4.0–9.4.3)...

PT-2026-62076

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted request to Entity Analytics endpoints. By providing an oversized input value, the attacker can trigger...

CVE-2026-31984

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...

EUVD-2026-42534

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...