CVE-2026-50787

CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre Summary A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre esiclivre. The vulnerable endpoint accepts user-controlled parameters that define CAPTCHA image dimensions, font size, and the...

CVE-2026-78058 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

CVE-2026-78058

Apache bRPC (versions

CVE-2026-94644

A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a...

CVE-2026-110843

The n8n workflow automation tool, versions before 2.41.4 and 2.42.x before 2.42.1 , contains an uncontrolled resource consumption vulnerability (CWE-770) in the unauthenticated OAuth authorize endpoint . The root cause is that the endpoint resolves clients via URL path but stores the caller's raw...

apache/thrift: thrift: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a...

CVE-2026-57227 Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.3.1 Patch 13 Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of...

CVE-2026-50270: Allocation of Resources Without Limits or Throttling

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...

CVE-2026-85585: Uncontrolled Resource Consumption

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85278

jackson-dataformat-toml 2.15.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6 and 3.2.0 before 3.2.2: TOML dotted keys create nested tables without checking StreamReadConstraints.maxNestingDepth for each key segment, so a long dotted key bypasses the nesting limit...

ROS-20260902-73-0024

The vulnerability in trivy is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by multiple vulnerabilities (CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325)

Summary There are multiple vulnerabilities in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling unbounded resource growth due to osslackmontxpacket in ssl/quic/quicackm.c and txppktcommit in ssl/quic/quictxp.c. A remote peer can exhaust memory by completing a QUIC handshake and...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, CVE-2026-15057, CVE-2026-11897, CVE-2026-10842, CVE-2026-9563, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171,...

CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74785

Scriban before 7.0.0 contains three denial-of-service vulnerabilities in expression evaluation: unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can trigger out-of-memory ...

CVE-2026-72684

This CVE affects Elasticsearch where an authenticated user with read privileges can trigger memory allocation by sending a crafted small search input, leading to an out-of-memory fatal condition and node denial of service. Affected versions: 8.0.0–8.19.19 and 9.0.0–9.4.4. Mitigation: upgrade to v...

CVE-2026-17199: Allocation of Resources Without Limits or Throttling

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation...