28308 matches found
PT-2026-96971
Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.17.4 Description An issue exists where the PSDImage.composite and PSDImage.numpy functions allocate output buffers based on geometry specified in the PSD header—including width, height, channels, depth, and...
PT-2026-96792
Name of the Vulnerable Software and Affected Versions Vector versions 0.15.0 through 0.56.0 Description The logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer accessing the default...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python (UTSA-2026-090108)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090108 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacke...
SUSE CVE-2026-93587
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...
SUSE CVE-2026-93590
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through...
Allocation of Resources Without Limits or Throttling
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded P2P KV offloading sessions in OffloadingConnector. Attackers can supply arbitrary...
urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...
CVE-2026-62370
KubeEdge is vulnerable to an unbounded memory allocation in the pkg/viaduct/pkg/packer component. The Reader.Read function trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates memory before validating an upper bound. An authenticat...
CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...
CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...
org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation
A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service DoS, making the affected system unavailable to legitimate users...
org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation
A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...
Apache Qpid Proton-Dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation
A flaw was found in Apache Qpid Proton Dotnet. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts. This could lead to excessive memory allocation, resulting in a denial of service DoS for the affected system...
netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory up to 32 MB per block before...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the absence of a total timeout in the remote policy fetch process. An attacker can cause the application to hang indefinitely by making a server respond extremely slowly, there...
io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...
CVE-2026-85220: Allocation of Resources Without Limits or Throttling
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...
ROS-20260921-73-0104
The vulnerability of the 389 Directory Server catalog service server is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...