6189 matches found
AI Under the Microscope—What’s Changed in the OWASP Top 10 for LLMs 2025
As AI continues to evolve, so do the threats and vulnerabilities that surround Large Language Models LLMs. The OWASP Top 10 for LLM Applications 2025 introduces critical updates that reflect the rapid changes in how these models are applied in real-world scenarios. While the list includes...
Allocation of Resources Without Limits or Throttling
Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of size limits or size checks when reading the request body into memory v...
CVE-2024-52581 Litestar allows unbounded resource consumption (DoS vulnerability)
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...
PT-2025-2948 · Elastic · Kibana
Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to "/api/metrics/snapshot". This can be carried out by users with...
Important: protobuf
Issue Overview: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf...
Mageia: Security Advisory (MGASA-2024-0364)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
netty-codec-http: Allocation of Resources Without Limits or Throttling
A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...
dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component
A vulnerability was found in .NET. Specifically .NET 9.0 Core - DoS - unbounded work factor in NrbfDecoder component...
FreeBSD : FreeBSD -- Unbounded allocation in ctl(4) CAM Target Layer (8caa5d60-a174-11ef-9a62-002590c1f29c)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8caa5d60-a174-11ef-9a62-002590c1f29c advisory. The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed...
CVE-2024-45289 Unbounded allocation in ctl(4) CAM Target Layer
The fetch3 library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch1 to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a...
CVE-2024-45289
The fetch(3) library in FreeBSD contains an improper initialization vulnerability where it incorrectly handles environment variables used to pass the revocation file pathname. Specifically, the environment variable name used by fetch(1) to communicate the filename to the library is incorrect, cau...
CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer
The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...
CVE-2024-39281
A vulnerability exists in the FreeBSD ctl subsystem, specifically in the ctl(4) CAM Target Layer . The ctl_persistent_reserve_out command fails to properly validate the size argument, allowing a caller to specify an arbitrary size that is passed directly to the kernel's memory allocator. This res...
CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer
The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...
Low: Red Hat Security Advisory: openssl and openssl-fips-provider security update
An update for openssl and openssl-fips-provider is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command
A flaw was found in Cyrus IMAP before versions 3.8.3 and 3.10.x , and before 3.10.0-rc1. This flaw allows authenticated attackers to cause unbounded memory allocation by sending multiple LITERALs in a single command...
Checking excessively long DSA keys or parameters may be very slow
OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...
Moderate: cyrus-imapd security update
The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command CVE-2024-34055 For more details about the security issues, including the impact, a CVSS...
RHEL 9 : cyrus-imapd (RHSA-2024:9195)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9195 advisory. The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd: unbounded memo...
