61961 matches found
CVE-2026-100648 vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
vllm before 0.29.0 fails to enforce VLLMMAXAUDIOCLIPFILESIZEMB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decodin...
CVE-2026-100648 vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
vllm before 0.29.0 fails to enforce VLLMMAXAUDIOCLIPFILESIZEMB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decodin...
CVE-2026-100648 vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding
vllm before 0.29.0 fails to enforce VLLMMAXAUDIOCLIPFILESIZEMB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decodin...
Hadoop-YARN-RCE
Unauthenticated RCE in Apache Hadoop YARN ResourceManager An unauthorized access vulnerability exists in Apache Hadoop YARN ResourceManager when its REST API default port 8088 or RPC ports are exposed without authentication enabled. By default, Hadoop leaves HTTP web consoles and RPC services...
CVE-2026-100558
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
CVE-2026-100540
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...
CVE-2026-100558
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
CVE-2026-100558
OpenClaw versions prior to 2026.8.1 are susceptible to a resource exhaustion vulnerability within the Gateway listener . This flaw allows unauthenticated clients to retain response sockets by submitting WebSocket upgrade requests that do not align with expected connection semantics. By repeatedly...
CVE-2026-100558 OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
CVE-2026-100558 OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
EUVD-2026-87492
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
CVE-2026-100558 OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...
CVE-2026-100542
The OpenClaw (npm package 'openclaw' ) versions >= 2026.5.28 and
CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...
CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...
CVE-2026-94400: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130...
CVE-2026-94397: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...
CVE-2026-100651: Uncontrolled Resource Consumption
vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' multimodal payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied...
CVE-2026-100648: Uncontrolled Resource Consumption
vllm before 0.29.0 fails to enforce VLLMMAXAUDIOCLIPFILESIZEMB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decodin...