CVE-2026-17508: Allocation of Resources Without Limits or Throttling

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-94645: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-102731: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service

The version of RabbitMQ installed on the remote host is 4.1.x prior to 4.1.11, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by a denial of service vulnerability: - The stream management HTTP API handler for super stream creation PUT...

openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21975-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21975-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remot...

SUSE SLES16 Security Update : rpcbind (SUSE-SU-2026:23946-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23946-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...

CVE-2026-61373: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

ImageMagick < 7.1.2-31 UHDR Encoder Policy Bypass

The remote host has a version of ImageMagick installed that is prior to 7.1.2-31. It is, therefore, affected by a vulnerability. - ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels...

PT-2026-104311

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift JavaME bindings where resources are allocated without limits or throttling. This can lead to resource exhaustion. Recommendations Update to version 0.25.0...

tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

GO-2026-6569 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

SummaryPSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

PYSEC-2026-4139 psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

CVE-2026-102504

A flaw was found in Imager. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying an out-of-range channel count parameter when reading raw image files. The application attempts an excessive memory allocation without validating the input, causing an unhandled allocati...

tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

Inefficient Algorithmic Complexity

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...

NPM: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

NPM: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated vulnerability discovered by ? in WordPress Npm devalue versions = 1.0.0, = 5.9.2...

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array...

Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...