CVE-2026-65324: Uncontrolled Resource Consumption

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad...

The vulnerability of the kho_test_init() function in the lib/test_kho.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the khotestinit function in the lib/testkho.c module of the Linux kernel is related to incorrect initialization of resources. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the usb_stor_Bulk_transport() function in the drivers/usb/storage/transport.c module of the Linux operating system’s USB device driver allows a hacker to induce a service failure.

The vulnerability of the usbstorBulktransport function in the drivers/usb/storage/transport.c file of the Linux device driver module is related to the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260729-73-0027

The vulnerability in coredns is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260729-73-0005

The vulnerability in python-PyPDF2 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the pegasus_probe() function in the drivers/input/tablet/pegasus_notetaker.c file of the Linux device driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pegasusprobe function in the drivers/input/tablet/pegasusnotetaker.c module of the Linux device driver framework is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability allows a remote attacker to compromise the...

The vulnerability of the smb3_fs_contextParseParam() function in the fs/smb/client/fsContext.c module, which is part of the SMB client support for Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the smb3fscontextParseParam function in the fs/smb/client/fsContext.c module, which is part of the SMB client support in Linux operating systems, involves the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker...

The vulnerability of the nvhdmi_mcp_probe() function in the sound/hda/codecs/hdmi/nvhdmi-mcp.c module of the Linux kernel sound subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nvhdmimcpprobe function in the sound/hda/codecs/hdmi/nvhdmi-mcp.c module of the Linux kernel’s sound subsystem is related to incorrect resource initialization. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

The vulnerability of the recv_pkt() function in the net/bluetooth/6lowpan.c module of the Linux kernel’s Bluetooth subsystem allows a hacker to cause a service failure.

The vulnerability of the recvpkt function in the net/bluetooth/6lowpan.c module of the Linux Bluetooth subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

CVE-2026-58151: Uncontrolled Resource Consumption

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4...

CVE-2026-67437: Uncontrolled Resource Consumption

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

The vulnerability of the cifs_construct_tcon() function in the fs/smb/client/connect.c module, which is part of the SMB client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the cifsconstructtcon function in the fs/smb/client/connect.c module, which is part of the SMB client support in Linux kernel, involves a flaw where resources are not released after their useful period has ended. Exploiting this vulnerability could allow an attacker to cause...

ROS-20260729-73-0022

The vulnerability in coredns is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260729-73-0023

The vulnerability in coredns is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the memfd_alloc_folio() function in the mm/memfd.c module of the Linux kernel’s memory management subsystem allows a hacker to gain unauthorized access to protected information.

The vulnerability of the memfdallocfolio function in the mm/memfd.c module of the Linux kernel’s memory management subsystem is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2026-65879

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.8 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An issue exists where insufficient resource throttling during the processing of merge request discussions...

CVE-2026-59899: Allocation of Resources Without Limits or Throttling

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

PT-2026-65853

Name of the Vulnerable Software and Affected Versions Logging operator versions prior to 6.6.0 Description The Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes Custom Resource Definition CRD strings directly into the fluent.conf file without proper...

PT-2026-65728

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4...

CVE-2026-63119: Uncontrolled Resource Consumption

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IOgets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This...