CVE-2026-81693

openssl_encrypt before 1.4.9 is vulnerable to a denial-of-service condition caused by insufficient validation of the total field in QR JSON payloads. An attacker can supply a crafted QR image with an extremely large total value, triggering unbounded memory allocation that leads to an out-of-memor...

EUVD-2026-67048

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-81692

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-81692 openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-81692

openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size a memory allocation via np.random.randint(size=(total_samples, channels)). A roughly 50-byte crafted FLAC file declaring ~100 million ...

CVE-2026-81692 openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO

opensslencrypt pip: openssl-encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO totalsamples field of FLAC files before using it to size an allocation np.random.randintsize=totalsamples, channels. A 50-byte crafted FLAC file declaring 100 million samples causes a...

CVE-2026-67551

A flaw was found in Apache Qpid Proton Dotnet. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts. This could lead to excessive memory allocation, resulting in a denial of service DoS for the affected system...

SUSE-SU-2026:3842-1 Security update for wicked

This update for wicked fixes the following issue: - CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing bsc1274627. - CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4 capture...

CVE-2026-63384

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system. Mitigation...

CVE-2026-12185

A flaw was found in Bouncy Castle for Java. The BKS/UBER keystore component allocates memory based on untrusted length values before performing an integrity check. A remote attacker could exploit this vulnerability by providing a specially crafted keystore, leading to excessive memory allocation...

EUVD-2026-66825

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

SUSE CVE-2026-68763

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

SUSE CVE-2026-72039

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2xallocmembp If the allocation of fpi.tpainfo fails, the error path will not free the struct bnx2xfastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by linking...

SUSE CVE-2026-72475

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...

SUSE CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...

SUSE CVE-2026-72495

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

CVE-2026-47891: Allocation of Resources Without Limits or Throttling

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

CVE-2026-30051: Allocation of Resources Without Limits or Throttling

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

ROS-20260827-73-0022

The vulnerability of the zcdncreate function in the drivers/s390/crypto/zcryptapi.c module of the Linux S390 kernel-based cryptography driver lies in the absence of any restrictions or regulations regarding resource allocation. Exploiting this vulnerability could allow a hacker to cause service...