CVE-2026-81535

In wolfSSH versions prior to 1.5.1, a vulnerability exists when built with the --enable-fwd flag. The DoChannelOpen() function in src/internal.c only applies forwarding policy callbacks to direct-tcpip channel opens, allowing forwarded-tcpip opens to bypass authorization checks and remain uncappe...

CVE-2026-81535 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

CVE-2026-81535 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

CVE-2026-81535: Missing Authorization

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

Summary A flaw in the recvContent function allows a malicious AMQP server to trigger an Out-of-Memory OOM error, forcing the host operating system or container runtime to immediately terminate the client process. Vulnerability Details When receiving message content payloads, the client processes...

CVE-2026-69202 Http4s Ember HTTP/2: unbounded inbound body buffering

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

CVE-2026-69218

Http4s Ember HTTP/2 is vulnerable to unbounded continuation frame accumulation in its H2Connection component. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, it buffers the header block and subsequent CONTINUATION fragments without a size bound . A remote peer can...

EUVD-2026-79195

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-45765

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

UBUNTU-CVE-2026-45765

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

CVE-2026-45765 Suricata dnp3: unbounded reassembly can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

EUVD-2026-75508

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

CVE-2026-53937

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

CVE-2026-53937

CVE-2026-53937 affects the MCP Kotlin SDK (versions 0.7.0–0.12.0 ). The root cause is an unbounded kotlinx.io.Buffer in ReadBuffer.append, which grows indefinitely when the stdio transport receives a byte stream without a terminating newline. The issue is amplified by StdioServerTransport and Std...

CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

EUVD-2026-74297

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...