CVE-2026-71310

The CVE affects the rclone project before version 1.75.0, where the shared HTTP CONNECT helper in lib/proxy/http.go incorrectly parses proxy CONNECT responses using http.ReadResponse over an unrestricted reader. This unbounded parsing enables a malicious or on-path proxy to send oversized headers...

keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-16100

CVE-2026-16100 describes a flaw in Keycloak where, when metrics are enabled, raw error messages from failed account operations are recorded as Prometheus metric labels. Because these messages may include user-supplied input (e.g., nonexistent client IDs), an authenticated user can generate an eno...

CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of symbol values. An attacker can exhaust system resources by sending specially crafted data prior t...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources by sending specially crafted requests prior to authentication. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching in the symbol process. An attacker can exhaust system resources and cause a denial of service by sending specially crafted requests prior to authentication...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the AMQP 1.0 incoming delivery handling in AbstractReceivingLinkEndpoint in broker-plugins/amqp-1-0-protocol. An authenticated attacker can force excessive resource usage by...

CVE-2026-67555

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version...

CVE-2026-66274

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service. Mitigati...

CVE-2026-70377

The CVE-2026-70377 entry affects imagecli. The vulnerability lies in the Scale::apply() function where output dimensions are computed as (dimension as f32 * ratio) as u32 without upper-bound validation on a CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. ...

CVE-2026-70377 imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a libra...

CVE-2026-70377

imagecli's scale pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio e.g. 100000 causes an...

CVE-2026-70377 imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a libra...

CVE-2026-70377 imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a libra...

CVE-2026-61485

...

httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial...

CVE-2026-61483 Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS

UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to...