CVE-2026-117501

HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, ...

EUVD-2026-112277

HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, ...

CVE-2026-117501

HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, ...

CVE-2026-117501: Allocation of Resources Without Limits or Throttling

HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, ...

PT-2026-128348

HTTP::Body versions before 1.24 01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF,...

SUSE CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

UBUNTU-CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

DEBIAN-CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824 Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824 Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

CVE-2026-115824

Starman versions before 0.4019 for Perl are vulnerable to memory exhaustion due to unbounded buffering of chunked request bodies. The underlying cause is that the chunked body decoder retains chunks in memory until completion without enforcing a limit on the length of a chunk-size line. A remote ...

EUVD-2026-109561

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a hu...

PT-2026-123060

Name of the Vulnerable Software and Affected Versions Starman versions prior to 0.4019 Description Starman for Perl allows memory exhaustion due to unbounded buffering of chunked request bodies. The chunked body decoder stores each chunk in memory until the entire chunk and its CRLF Carriage Retu...

CVE-2026-16251

Mattermost versions 11.10.x <= 11.10.0 , 11.7.x <= 11.7.9 , 11.9.x <= 11.9.1 , and 11.8.x

CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...

CVE-2026-109339: Allocation of Resources Without Limits or Throttling

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing...

msgpack5: Reserved byte can cause unbounded stream buffering

Impact The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion. Patches The decoder now reject...