Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130129)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130129 advisory. Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1...

BIT-THRIFT-2026-96990 Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94657 Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66331 Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66054 Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-63772 Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-61374 Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109176

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109171

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-DN30065 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings

Security vulnerability affects the apache-hive package. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings...

CVE-2026-94440: Allocation of Resources Without Limits or Throttling

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

CVE-2026-106450: Allocation of Resources Without Limits or Throttling

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java. An attacker can force excessive CPU work by supplying a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java. An attacker can force excessive CPU work by supplying a...

Linux Distros Unpatched Vulnerability : CVE-2026-61374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are...

Linux Distros Unpatched Vulnerability : CVE-2026-63772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are...