CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

CVE-2026-82728

Mint (the Elixir HTTP client library, elixir-mint/mint) suffers from unbounded buffering in its HTTP/1 response parser. In lib/mint/http1.ex, decode_status_line/4 and decode_body/5 accumulate unconsumed server data in conn.buffer without any size cap, because the :max_header_list_size budget is o...

CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

EUVD-2026-71220

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

EEF-CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex,...

CVE-2026-71979

A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...

EUVD-2026-71083

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

CVE-2026-82309

The Robots::Validate Perl module (versions 0.3.2 through 0.3.10 ) is vulnerable to unbounded outbound DNS queries. The issue resides in the _check_dns function, which initiates a forward-confirmation loop. When a client's User-Agent matches a rule, the module issues a PTR query and then issues fo...

CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85585 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85585 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85585 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85585

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in its request-concurrency middleware (ControlConcurrency). The middleware retains mutex entries for every unique request path without any eviction mechanism . An unauthenticated remote attacker can send numerous unique...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

EUVD-2026-71005

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler . Authenticated attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite proce...