CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

EUVD-2026-74297

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...

CVE-2026-82054

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...

CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86734

Snipe-IT versions before 8.7.1 are affected by a denial-of-service vulnerability in the POST /account/accept/{acceptance} endpoint. The root cause is the absence of length validation on the note field , allowing authenticated users to submit arbitrarily large values that trigger synchronous Commo...

EUVD-2026-72870

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-81928

A flaw was found in Net::DNS versions before 1.57 for Perl. An attacker can cause a denial of service DoS by sending a specially crafted DNS message with a misplaced Transaction Signature TSIG record. When a system using Net::DNS, such as a forwarder or proxy, attempts to re-encode this message, ...

SUSE-SU-2026:4086-1 Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issue: - CVE-2026-81928: memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record bsc1278084...

Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issue: CVE-2026-81928: memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record bsc1278084. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

EUVD-2026-72651

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

SUSE-SU-2026:4074-1 Security update for wget

This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962...

SUSE-SU-2026:4065-1 Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issue: - CVE-2026-81928: memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record bsc1278084...

Security update for perl-Net-DNS

This update for perl-Net-DNS fixes the following issue: CVE-2026-81928: memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record bsc1278084. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the tokensFromInput method of TreePointer, which parses JSON Pointer segments with repeated substring calls that copy the remaining string each iteration On^2 and accumulates the...