CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

Security Bulletin: IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage.

Summary IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage. IBM ApplinX has been updated in order to address the vulnerability CVE-2026-45292. Vulnerability Details CVEID:CVE-2026-45292 DESCRIPTION:...

PYSEC-2026-3798

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

PYSEC-2026-3798

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81721

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693

openssl_encrypt before 1.4.9 is vulnerable to a denial-of-service condition caused by insufficient validation of the total field in QR JSON payloads. An attacker can supply a crafted QR image with an extremely large total value, triggering unbounded memory allocation that leads to an out-of-memor...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

PT-2026-82616

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate Key Derivation Function KDF cost parameters within encrypted file metadata and keystore headers. This allows an unauthenticated attacker to trigger unbounded...

PT-2026-82594

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the total field within QR JSON payloads before materializing ranges. An attacker can provide specially crafted QR images containing extremely large values in th...

CVE-2026-81721: Uncontrolled Resource Consumption

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-47859

CVE-2026-47859 affects Spring Integration 's RFC6587SyslogDeserializer , the component used by the syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames. The root cause is that the deserializer trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array o...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...