CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

EUVD-2026-95807

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

SUSE SLED15 / SLES15 Security Update : rpcbind (SUSE-SU-2026:4568-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4568-1 advisory. - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. -...

CLEANSTART-2026-NG64377 Unbounded memory allocation in Google Guava 11

Security vulnerability affects the apache-hive package. Unbounded memory allocation in Google Guava 11...

Security update for rpcbind

This update for rpcbind fixes the following issues: CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch...

SUSE-SU-2026:4568-1 Security update for rpcbind

This update for rpcbind fixes the following issues: - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326...

Security Bulletin:Netty TLS ClientHello Length Vulnerability: Unbounded Memory Allocation

Summary Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

SUSE SLES12 Security Update : rpcbind (SUSE-SU-2026:4446-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4446-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...

CVE-2026-59323

A flaw was found in Micrometer Tracing's Brave bridge when using W3C baggage propagation. A remote attacker can exploit this by sending specially crafted requests with excessively large baggage headers. This can lead to unbounded memory allocation, causing high CPU usage, increased garbage...

Security update for rpcbind

This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attack...

Improper Validation of Specified Quantity in Input

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attacker can cause...

openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21975-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21975-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remot...

SUSE SLES16 Security Update : rpcbind (SUSE-SU-2026:23946-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23946-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...

SUSE CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2024_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243253 advisory. libvirt: negative gnew0 length can lead to unbounded memory allocation CVE-2024-2494 Tenable has extracted the preceding description block directly from the CIQ...