netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

Security update for rpcbind

This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

CVE-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-OZ83684 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the consul package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21975-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21975-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remot...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

CLEANSTART-2026-TF22707 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the kube-state-metrics-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2023_0446)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230446 advisory. golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseable...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2024_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243253 advisory. libvirt: negative gnew0 length can lead to unbounded memory allocation CVE-2024-2494 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2560)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242560 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...

Rocky Linux 9 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2024_9333)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249333 advisory. openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time spent checking DSA keys and parameters CVE-2024-460...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing...

Rocky Linux 8 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (crlsa-2019_4273)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20194273 advisory. HTTP/2: flood using PING frames results in unbounded memory growth CVE-2019-9512 HTTP/2: flood using HEADERS frames results in unbounded memory growth...

Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2026_53452)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202653452 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2024_9195)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249195 advisory. cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command CVE-2024-34055 Tenable has extracted the preceding description block directly...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762539123)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762539123 advisory. - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39321 - QUIC connections do not...

Rocky Linux 10.2 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2026_53451)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202653451 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 Tenable has extracted the preceding...

CVE-2026-103471 restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

EUVD-2026-89017

urllib3: HTTPResponse.stream/readchunked buffers an unbounded chunk-size line into memory...

AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (ALMALINUX9.2:CLSA-2026:1779119949)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779119949 advisory. - Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many...