6465 matches found
CVE-2026-59248
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...
BIT-THRIFT-2026-45112 Apache Thrift: Unbounded Read Leading to Denial of Service
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
BIT-THRIFT-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
SUSE-SU-2026:23006-1 Security update for python-pyasn1
This update for python-pyasn1 fixes the following issues: This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID...
CVE-2026-51273
...
CVE-2026-51263
...
CVE-2026-51273
CVE-2026-51273 entry is rejected/not used per the initial description.
CVE-2026-14981: Uncontrolled Resource Consumption
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits...
PT-2026-65532
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...
CVE-2026-54345: Integer Underflow (Wrap or Wraparound)
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...
PT-2026-65645
Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...
AZL-94074 CVE-2026-64549 affecting package kernel for versions less than 6.6.145.2-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...
DEBIAN-CVE-2026-59251
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
AZL-94202 CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-4
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
CVE-2026-59251
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the mapDecoder.Decode and mapDecoderUnmarshaler.Decode methods in codecmap.go, which use the attacker-controlled map block element count both to pre-size the destination map and as...
GO-2026-6082 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev...
GO-2026-5960 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) in github.com/xuri/excelize
Excelize: Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS in github.com/xuri/excelize...
GO-2026-5983 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...