6466 matches found
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via XML encryption processing. An attacker can cause denial of service by supplying a crafted XML document that triggers excessive resource consumption or causes the application to...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via XML encryption processing. An attacker can cause denial of service by supplying a crafted XML document that triggers excessive resource consumption or causes the application to...
Uncontrolled Resource Consumption
github.com/stackloklabs/mkp is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the server accepting unbounded limitBytes and tailLines values and reading the entire Kubernetes pod log stream into memory without enforcing a size limit, which allows an...
PT-2026-60365
Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.32.8 Description Pomerium is an identity and context-aware access proxy. In hosted or stateless authentication deployments, the /.pomerium/callback endpoint is reachable without credentials and processes...
Linux Distros Unpatched Vulnerability : CVE-2026-60081
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data fo...
Linux Distros Unpatched Vulnerability : CVE-2026-39244
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103,...
Loki detected_fields query limits results in unbounded memory allocation
The Loki detectedfields endpoint allocates 2limit elements in slices and maps based on the user-supplied limit query parameter, regardless of actual result count. A massive limit value e.g. 600000000 allocates 20-30 GiB even with zero matching results, causing OOM, resulting in denial of service...
PT-2026-60362
Name of the Vulnerable Software and Affected Versions Datadog .NET Tracer versions prior to 3.43.0 Description Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing limits on the number of items or the total byte size during...
PT-2026-60363
Name of the Vulnerable Software and Affected Versions dd-trace-go versions prior to 2.8.1 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...
dd-trace-rb - Improper parsing of W3C baggage headers may lead to DoS
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...
CVE-2026-46629 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...
CVE-2026-46629 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...
DEBIAN-CVE-2026-49855
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...
CVE-2026-46627
CVE-2026-46627 concerns Twig, a PHP template engine. Before 3.26.0, Twig’s sandbox does not prevent a template from consuming CPU, memory, or wall-clock time even with an allow-list, allowing resource exhaustion via unbounded for/range usage. The issue is mitigated in version 3.26.0, which docume...
CVE-2026-46627 Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenti...
CVE-2026-46627 Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenti...
CVE-2026-46627 Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under the strictest allow-list, allowing untrusted templates to cause resource exhaustion. This issue is addressed in version 3.26.0 by documenti...
CVE-2026-49855
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...
