6526 matches found
Denial Of Service (DoS)
@libp2p/gossipsub is vulnerable to Denial of Service DoS. The vulnerability is due to missing limits on subscription entries, unbounded topic handling, and failure to clean up empty topic sets, which allows an attacker to exhaust Node.js heap memory and crash the process through crafted...
AZL-88320 CVE-2026-39827 affecting package telegraf for versions less than 1.31.0-23
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...
AZL-87170 CVE-2026-39827 affecting package buildah 1.43.1-3
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...
AZL-87411 CVE-2026-39827 affecting package cert-manager for versions less than 1.12.15-9
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...
AZL-87260 CVE-2026-39827 affecting package cri-o 1.30.1-1
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...
AZL-87978 CVE-2026-39827 affecting package kubevirt for versions less than 1.7.1-7
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...
Progress MOVEit Automation 2025.0.x < 2025.0.11 / 2025.1.x < 2025.1.7 Multiple Vulnerabilities
The version of Progress MOVEit Automation installed on the remote host is 2025.0.x prior to 2025.0.11 or 2025.1.x prior to 2025.1.7. It is, therefore, affected by multiple vulnerabilities: - Uncontrolled Memory Allocation vulnerability allows excessive allocation. CVE-2026-8485 - Allocation of...
Linux Distros Unpatched Vulnerability : CVE-2026-28376
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to...
Linux Distros Unpatched Vulnerability : CVE-2026-8466
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart...
js-libp2p: Memory DoS via subscription flood of unique topics
Summary Three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. 1. defaultDecodeRpcLimits.maxSubscriptions = Infinity packages/gossipsub/src/message/decodeRpc.ts:11: no decode-level cap on...
GHSA-4F8R-922H-2VGV js-libp2p: Memory DoS via subscription flood of unique topics
Summary Three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. 1. defaultDecodeRpcLimits.maxSubscriptions = Infinity packages/gossipsub/src/message/decodeRpc.ts:11: no decode-level cap on...
bind: Unbounded resend loop in BIND 9 resolver
A flaw was found in BIND 9. A remote, unauthenticated attacker can exploit an unbounded resend loop vulnerability in the resolver state machine during bad-server handling. By sending specially crafted queries that trigger specific retry conditions, the attacker can cause severe resource exhaustio...
image-builder security update
An update is available for image-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A local binary for building customized OS artifacts such as VM images...
osbuild-composer security update
An update is available for osbuild-composer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images an...
tomcat6: Fix of CVE-2026-41284
CVE-2026-41284: tomcat6: WebDAV LOCK/PROPFIND unbounded request body DoS...
CVE-2026-44070
A flaw was found in Netatalk. An attacker with low privileges could exploit an unbounded reallocation realloc vulnerability during charset conversion. This could lead to a Denial of Service DoS due to excessive memory consumption...
CLSA-2026-1779366970 tomcat6: Fix of CVE-2026-41284
CVE-2026-41284: tomcat6: WebDAV LOCK/PROPFIND unbounded request body DoS...
CVE-2026-44070
An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests...
