RHEL 8 : rpcbind (RHSA-2026:83563)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:83563 advisory. The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to ...

PT-2026-114834

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

rpcbind security update

1.2.6-7.1 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service - Resolves: RHEL-266677...

rpcbind security update

1.2.5-11 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266668...

rpcbind security update

1.2.7-3.1 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266672...

CVE-2026-110833 FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

Unity Linux 20.1070a Security Update: libssh (UTSA-2026-130121)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130121 advisory. A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory...

GHSA-F4G7-52WC-P8X7 Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Localization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.win-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling vi...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

CVE-2026-33374

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-33374 Unbounded memory allocation in the Prometheus rule conversion API

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions...

CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana are vulnerable to an unbounded memory allocation issue. Because the application does not limit the request body size , authenticated users can trigger excessive memory consumption, potentially causing a server crash due to out-of-memory (OOM...

CVE-2026-93186

A flaw was found in the Linux kernel's Compute Express Link CXL mailbox driver. A local attacker could exploit an unbounded memory allocation vulnerability in the CXLMEMSENDCOMMAND function. By providing a large output size, an attacker could trigger a huge memory allocation, potentially leading ...

SUSE-SU-2026:4650-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910...

CVE-2026-109227

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocessvideo in qwenvl.py that decodes frames at full source resolution before applying maxpixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and...

EUVD-2026-97433

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocessvideo in qwenvl.py that decodes frames at full source resolution before applying maxpixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and...

Important: python3.13-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Important: python-urllib3

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...