CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

EUVD-2026-89015

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-84784 QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-54873 QUIC STREAM Fragment Metadata DoS

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...

CVE-2026-54873

A flaw in OpenSSL allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted network packets to a QUIC protocol endpoint. The vulnerability occurs because the QUIC stack retains memory in packet buffers until the receiving application copies the stream data, a design...

CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-97598

A flaw was found in the Linux kernel's IPv4 routing subsystem. This vulnerability allows a local user with network configuration privileges to cause a Denial of Service DoS. When automatic routing table identifier allocation is requested, the kernel searches through table identifiers without an...

RUSTSEC-2026-0317 A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-15057)

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11897)

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-11897 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially...

CLEANSTART-2026-HO72909 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-MI40861 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-QF48371 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings

Security vulnerability affects the spark-sc212-jdk17-py311 package. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings...

The vulnerability of the microprogramming software of Reyrolle 7SR5 devices, related to the distribution of resources without any restrictions or regulation, allows a intruder to cause malfunctions during maintenance operations.

The vulnerability of the microprogramming software of Reyrolle 7SR5 devices for relay protection and automation systems lies in the fact that resources are allocated without any restrictions or controls during the processing of HTTP requests. Exploiting this vulnerability allows a remote attacker...

CVE-2026-54873: Allocation of Resources Without Limits or Throttling

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for...