502 matches found
CVE-2026-125205: FFmpeg: FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that…
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1framemerge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited...
PT-2026-141033
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1 frame merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimit...
CVE-2026-73095 Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an...
CVE-2026-73095
Apache Juneau versions through 9.2.0 are vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability. The MessagePack parser , enabled by default in the REST server, sizes buffers based on length values provided in the input. An unauthenticated client can send a small amou...
EUVD-2026-116829
Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ the .NET OpenWire client, package Apache.NMS.ActiveMQ before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame...
RLSA-2026:85930 Important: python-urllib3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Important: Red Hat Security Advisory: python-urllib3 security update
An update for python-urllib3 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
RUSTSEC-2026-0435 Unbounded memory allocation in `thrift` binary protocol `read_bytes`
Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...
Unbounded memory allocation in `thrift` binary protocol `read_bytes`
Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...
python3.12-urllib3 security update
An update is available for python3.12-urllib3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...
Rocky Linux 8 [CIQ] Security Update: python3-urllib3 (crlsa-2026_90759)
The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202690759 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block directly...
RLSA-2026:90494 Important: python-urllib3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
OESA-2026-4625 python-urllib3 security update
Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...
Oracle Linux 8 : python3.12-urllib3 (ELSA-2026-92474)
The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-92474 advisory. - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 Tenable has extracted the preceding descripti...
Denial Of Service (DoS)
org.xerial.snappy, snappy-java is vulnerable to denial of serviceDoS. The vulnerability is due to unbounded memory allocation based on the declared uncompressed length in crafted compressed input, which allows an attacker to exhaust JVM memory by triggering allocations of up to 2 GB and causing a...
MiracleLinux 8 : python-urllib3-1.24.2-11.el8_10 (AXSA:2026-2181:06)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2181:06 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 Tenable has extracted the preceding description block...
GHSA-F5M9-JFRJ-JJJ7 OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Summary JaegerPropagator.extract in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept...
EUVD-2026-95807
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha...
TencentOS Server 4: python-urllib3 (TSSA-2026:1192)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1192 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
MiracleLinux 9 : python-urllib3-1.26.5-8.el9_8.2 (AXSA:2026-2170:05)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2170:05 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS...