1019 matches found
BIT-THRIFT-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CLEANSTART-2026-FE09696 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption
CVE-2025-58181 affects multiple packages. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability details...
SUSE SLED15 / SLES15 Security Update : rpcbind (SUSE-SU-2026:4568-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4568-1 advisory. - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. -...
CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...
CLEANSTART-2026-NG64377 Unbounded memory allocation in Google Guava 11
Security vulnerability affects the apache-hive package. Unbounded memory allocation in Google Guava 11...
CLEANSTART-2026-CX44155 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...
CLEANSTART-2026-RD95849 TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption
CVE-2026-46602 affects multiple packages. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. See references for individual vulnerability details...
Security update for rpcbind
This update for rpcbind fixes the following issues: CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch...
SUSE-SU-2026:4568-1 Security update for rpcbind
This update for rpcbind fixes the following issues: - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting bsc1272340. - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326...
Security Bulletin:Netty TLS ClientHello Length Vulnerability: Unbounded Memory Allocation
Summary Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
AZL-106107 CVE-2026-98234 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...
CVE-2026-98234 net/sched: hhf: cap hh_flows_limit at change time
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...
CLEANSTART-2026-PD83002 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption
Security vulnerability affects the prometheus-redis-exporter-fips package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...
SUSE SLES12 Security Update : rpcbind (SUSE-SU-2026:4446-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4446-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...
CVE-2026-59323
A flaw was found in Micrometer Tracing's Brave bridge when using W3C baggage propagation. A remote attacker can exploit this by sending specially crafted requests with excessively large baggage headers. This can lead to unbounded memory allocation, causing high CPU usage, increased garbage...
Security update for rpcbind
This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...
Improper Validation of Specified Quantity in Input
Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attack...
Improper Validation of Specified Quantity in Input
Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the TJSONProtocol process. An attacker can cause...