CVE-2026-11873 Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

CVE-2026-11873

Red Hat IdM (Identity Management) exposes an Apache-proxied Dogtag CA REST endpoint (POST /ca/rest/certrequests ) that, upon receiving an unauthenticated malformed or empty request, returns an HTTP 500 response containing internal Java stack traces . The same unauthenticated error path writes lar...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 are affected by a policy exception handling flaw . When a policy in enforce mode is combined with two PolicyExceptions , the less restrictive exception takes precedence. An attacker can exploit this by crafting a resource name that matches the second except...

CVE-2026-42391

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...

BIT-GITLAB-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

A flaw was found in the Linux kernel's Network File System Daemon NFSD. An issue with file access counting in the nfsd4addrdaccesstowrdeleg function can lead to an extra access count for nfs4file objects. This prevents the proper freeing of associated resources when the NFS server service is...

ManualRsrcDataFetching

ManualRsrcDataFetching：一个用于替代 FindResource & LoadResource & LockResource & SizeofResource Windows API 的函数。 注意：Payload.ico 是一个 x64 calc shellcode...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2024-24549

ここに、Apache TomcatにおけるHTTP/2リクエストの不適切な入力検証によるサービス拒否（DoS）脆弱性を実証するProof of Concept（PoC）のREADME.mdを示します。 Apache Tomcatにおけるサービス拒否（DoS）脆弱性のProof of Concept（PoC） このリポジトリには、Apache Tomcatのサービス拒否（DoS）脆弱性を実証するProof of Concept（PoC）スクリプトが含まれています。この脆弱性は、HTTP/2リクエストの不適切な入力検証に起因し、DoS状態を引き起こす可能性があります。 脆弱性の説明 CVE-...

CVE-2025-63914

CVE-2025-63914 CVE-2025-63914 的公开披露与补丁：Cinnamon/kotaemon 中的 ZIP 炸弹漏洞。 致谢 Wang Yuanrong 摘要 mayextractzip 函数未对 ZIP 解压缩施加限制，使恶意的 ZIP 炸弹能够触发过多的资源消耗并导致拒绝服务。 详情 \libs\ktem\ktem\index\file\ui.py 文件中的 mayextractzip 函数未检查上传 ZIP 文件的内容。尽管这些内容会被解压到一个临时文件夹中（该文件夹在每次解压前会清空），但成功上传一个 ZIP...

CVE-2026-82742

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82743

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82743

ash-project ash (Elixir framework) contains an uncontrolled resource consumption vulnerability in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1. The function polled outstanding async read tasks with Task.yield(task, 0) in a tight loop rather than blocking, causing a BEAM scheduler to spin at...

EUVD-2026-68948

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...