EUVD-2026-58234

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded allocation of pending connections in portdefaultpackethandler. An attacker can exhaust memory and make the QUIC listener unavailable by sending many valid QUIC Initia...

ALPINE-CVE-2026-53794

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

ALPINE-CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

UBUNTU-CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-53794

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

EUVD-2026-57919

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by t...

UBUNTU-CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

AZL-95598 CVE-2026-71218 affecting package iperf3 3.17.1-4

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the JSONread function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of...

CVE-2026-71218

CVE-2026-71218 in iperf3 involves a flaw in the JSON_read() function where a peer-controlled message length is accepted and memory is allocated without an upper bound. This can cause excessive memory consumption, leading to DoS via memory exhaustion, severe slowdown, or service termination. The i...

PT-2026-70075

Name of the Vulnerable Software and Affected Versions Samsung Open Source rlottie affected versions not specified Description An issue exists where improper validation of the specified quantity in the input and the allocation of resources without limits or throttling allows for excessive...

CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

CVE-2026-61485 Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index

UNSUPPORTED WHEN ASSIGNED Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access ...

CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...

UBUNTU-CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...