OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.0 of CNCF’s OpenTelemetry Python contain a resource management error vulnerability. This vulnerability arises because JaegerPropagator.extract fails to limit the number of entries, their size per entry, and the total size when processing incoming uberctx-...

Eugene Russh resource management error vulnerability

Versions of Eugene Russh prior to 0.65.0 contain a resource management error vulnerability. This vulnerability arises because the client accepts a private EXTINFO message with encoded ID 7 via the Session::processpacket path; however, the handleextinfo function adds extension names to...

lxsmnsyc seroval resource management error vulnerability

In versions lxsmnsyc seroval from 1.4.1 up to but including 1.6.8, there is a resource management error vulnerability. This vulnerability arises because fromJSON and fromCrossJSON fail to require that the list of elements in array nodes be an actual array. A specially crafted payload can allow...

Mattermost resource management error vulnerability

Versions 11.9.1 and earlier of Mattermost, as well as versions 11.8.5 and earlier, 11.7.10 and earlier, and 11.10.1 and earlier are affected by a resource management error vulnerability. This vulnerability arises because the WebSocket msgpack decoder fails to enforce allocation limits on byte...

vLLM resource management error vulnerability

Versions prior to vLLM 0.32.0 contain a resource management error vulnerability. This vulnerability arises because the Phi-4 multimodal audio encoder defaults to using eager attention in phi4mmaudio.py and phi4mmutils.py. A remote client can submit a valid long audio segment, causing the full...

Mattermost resource management error vulnerability

Mattermost versions 11.9.1 and earlier within the 11.9.x series, 11.8.5 and earlier within the 11.8.x series, 11.7.10 and earlier within the 11.7.x series, and 11.10.1 and earlier within the 11.10.x series contain a resource management error vulnerability. This vulnerability arises from the lack ...

BenoitC Hackney resource management error vulnerability

Versions 2.0.0-beta.1 through 4.9.0 of benoitc hackney contain a resource management error vulnerability. This vulnerability arises because hackneyconn fails to restrict or throttle resource allocation; as a result, hackney:request/5 and hackney:body/1 return full response bodies without limiting...

Qt resource management error vulnerability

Qt has a resource management error vulnerability stemming from HTTP/2 client support allowing post-free reuse. This may cause client applications running on malicious or compromised HTTP/2 servers to crash, thereby affecting availability...

Twisted Matrix Labs Twisted resource management error vulnerability

Versions of Twisted Matrix Labs Twisted prior to 26.10.0rc1 contain a resource management error vulnerability. This vulnerability arises because twisted.words.protocols.irc.IRC.dataReceived fails to limit line length; it retains bytes without newline characters prior to authentication. As a resul...

Twisted Matrix Labs Twisted resource management error vulnerability

Versions of Twisted Matrix Labs Twisted prior to 26.10.0rc1 contain a resource management error vulnerability. This vulnerability arises because the twisted.words.xish.domish ExpatElementStream parser fails to limit memory usage for unfinished elements. Unauthenticated remote attackers can exploi...

Pypdf resource management error vulnerability

Versions of pypdf prior to 6.21.2 contain a resource management error vulnerability. This vulnerability arises when an attacker can craft a specially formatted PDF containing a standard cross-reference table with a claimed number of entries exceeding what the file can actually hold. As a result,...

OpenBao resource management error vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a resource management error vulnerability. This vulnerability arises from the rate limit quota subsystem’s failure to properly parse the role of form-encoded request bodies or forwarded certificates; as a result, quota rule...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance versions prior to 36.0.16, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1 contain a resource management error vulnerability. This vulnerability stems from waSTM time-wasi-http failing to enforce a write check limit on the WASIp2 outbound HTTP body, thereby allowing excessively...

Expat development team Expat resource management error vulnerability

The Expat development team identified a resource management error vulnerability in Expat versions 2.9.0 and earlier. This vulnerability stems from an overly delayed amplification of the billion laughs protection check within accountingDiffTolerated in xmlparse.c. An attacker can supply an XML...

PHPOffice PhpSpreadsheet resource management error vulnerability

Versions prior to PHPOffice PhpSpreadsheet 1.30.7, versions 2.0.0 through 2.1.19, versions 2.2.0 through 2.4.8, versions 3.3.0 through 3.10.8, and versions 4.0.0 through 5.10.0 contain a resource management error vulnerability. This vulnerability stems from Ods::processTableRow in...

National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

Versions 10.3 through 12.2 of the National Security Agency Ghidra Software Reverse Engineering Framework contain a resource management error vulnerability. This vulnerability arises because the ThemeReader.readZipTheme function fails to limit resource allocation when extracting theme ZIP entries...

HAProxy resource management error vulnerability

Versions prior to HAProxy 3.0.30, 3.2.26, 3.3.17, 3.4.6, and 3.5-dev9 contain a resource management error vulnerability. This vulnerability arises because the HTTP/1.1 chunked request parser repeatedly processes identical bytes without advancing its state, causing affected worker threads to...

Bob Halley DNSPython resource management error vulnerability

Bob Halley: A resource management error vulnerability exists in dnspython versions prior to 2.9.0. This vulnerability arises because dns.name.fromwireparser fails to limit the number of jumps when processing DNS compressed pointer chains. Malicious DNS packets can force excessive pointer traversa...

MessagePack resource management error vulnerability

Versions of MessagePack prior to 1.2.3 contain a resource management error vulnerability. This vulnerability arises because the C extension fails to deserialize values when strictmapkey is set to True; as a result, decoded map values are leaked. Repeated malformed inputs can lead to unbounded...

Drupal Combined image style resource management error vulnerability

In Drupal, there is a resource management error vulnerability in versions 0.0.0 through 1.0.7. This vulnerability arises from the lack of restrictions or throttling on resource allocation, potentially leading to excessive resource consumption...