Important: python-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-3171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3171 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...

Amazon Linux 2 : python-urllib3 (ALAS-2026-3973)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3973 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2026-3184)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3184 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...

CVE-2026-108106

A flaw was found in snappy-java. A remote attacker can exploit this unbounded memory allocation vulnerability by providing crafted compressed input with an excessively large declared uncompressed size during decompression. Successful exploitation allows the attacker to exhaust available system...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references. Original Description Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to...

GHSA-94X4-5G3F-JJXP Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references. Original Description Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

The Xerial snappy-java library before version 1.1.10.9 is vulnerable to an unbounded memory allocation flaw. An attacker can provide crafted bytes to the Snappy.uncompress , uncompressString , SnappyInputStream , or SnappyFramedInputStream functions, declaring a large uncompressed length within a...

BIT-THRIFT-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-FE09696 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

CVE-2025-58181 affects multiple packages. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability details...

SUSE SLED15 / SLES15 Security Update : rpcbind (SUSE-SU-2026:4568-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4568-1 advisory. - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. -...

CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

CLEANSTART-2026-NG64377 Unbounded memory allocation in Google Guava 11

Security vulnerability affects the apache-hive package. Unbounded memory allocation in Google Guava 11...

CLEANSTART-2026-CX44155 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-RD95849 TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption

CVE-2026-46602 affects multiple packages. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. See references for individual vulnerability details...