CVE-2026-1168 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

CVE-2026-1168 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

EUVD-2026-80122

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

CVE-2026-1168

GitLab CE/EE is affected by a denial of service vulnerability in the GraphQL complexity calculation logic , where improper resource allocation limits allow an unauthenticated attacker over the network to exhaust server resources. The issue affects all versions from 18.4.6 before 19.1.8 , 19.2 bef...

CVE-2026-1168: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

CVE-2026-89877: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

CVE-2025-14871: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

PT-2026-93320

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an unauthenticated user can cause a denial of service. This occurs due to imprope...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by an improper validation vulnerability in Bcpkix CVE-2025-12802, an allocation of resources without limits vulnerability in Bcpkix CVE-2026-13586, an allocation of resources without limits vulnerability in Bcpkix CVE-2026-15055, an improper...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.3.1 Patch 13 Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ath11k: fixed the netdev open race condition. Make sure to allocate the necessary resources before registering the device. This specifically prevents a race condition where open triggers a BUGON in modtimer, when ath11kmacopstart...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Memory issue: fslifc – fixed the leak of private memory during probe failures. During probe errors, the driver should release the memory allocated for private structures. This issue was fixed by using resource-managed allocation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: hns3 – The use of numtqps in the vf driver to allocate resources. Currently, hdev-htqp is allocated using hdev-numtqps, and kinfo-tqp is allocated using kinfo-numtqps. However, kinfo-numtqps is set to minnewtqps,...

Astra Linux – Vulnerability in Tomcat9

The “Allocation of Resources Without Limits or Throttling” vulnerability in Apache Tomcat exists. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, and from 9.0.0.M1 through 9.0.105. The following versions were already at the end of their...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx4en: A use-after-free bug has been fixed in mlx4entryallocresources. In mlx4entryallocresources, mlx4encopypriv is called, and tmp-txcq will be freed during the error path of mlx4encopypriv. After that, mlx4enallocresource...

Astra Linux – Vulnerability in Apache2

The vulnerability of “Allocation of Resources Without Limits or Throttling” in Apache HTTP Server’s modmd, through OCSP response data. This issue affects Apache HTTP Server versions 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes this issue...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Unallocated resources are no longer allowed to be returned. In cases where the topology requests resources that have not been created by the system since they are typically not represented in dpumdsscfg, the resource...

CVE-2026-90584

A flaw was found in TooTallNate Java-WebSocket. A remote attacker can exploit a weakness in the processFrameContinuousAndNonFin function within the Fragmentation Handler component. This vulnerability allows for excessive allocation of resources, which can lead to a Denial of Service DoS condition...

CVE-2026-50270: Allocation of Resources Without Limits or Throttling

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-90584

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...