6056 matches found
CVE-2026-101333
A flaw in the Micrometer user-event metrics listener of Keycloak , an identity and access management solution, allows an unauthenticated attacker to create an unlimited number of metric time series. This occurs when the listener is configured to include the idp tag and an attacker sends requests ...
ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...
ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...
CVE-2025-26466
CVE-2025-26466 PoC para CVE-2025-26466 hecho por Fikret Can Gurbuz USO python3 poc.py -i -p Estos son los pasos: 1. Conexión TCP al puerto 2. recibir el banner del servidor SSH-2.0-OpenSSHX.Xp1 3. enviar tu banner de cliente SSH-2.0-YourClient\r\n 4. enviar wrapsshpacketbuildkexinit 5. recibir la...
Linux Distros Unpatched Vulnerability : CVE-2026-100656
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...
CVE-2025-52413
CVE-2025-52413 — Particle Device OS BLE Buffer Overflow Discoverer : Golden Ticket Labs Vendor : Particle Date Assigned : August 12th 2025 MITRE Description A buffer overflow in the blecontrolrequestchannel.cpp component of Particle Device OS v5.6.0 enables arbitrary function pointer overwrite du...
CVE-2026-100661
A flaw was found in Netty's HTTP/3 codec. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted stream of data to the QPACK integer decoder. Because the decoder fails to limit incoming continuation bytes, data accumulates indefinitely in memory while...
CVE-2026-100661
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...
DEBIAN-CVE-2026-100656
Bulletin has no description...
CVE-2026-100658
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2026-100660
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100656
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100660
The Netty HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final are vulnerable to a denial of service (DoS) due to unbounded per-stream QPACK encoder state retention. The QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section re...
EUVD-2026-87752
Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...
