CVE-2026-68494: Allocation of Resources Without Limits or Throttling

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: AlmaLinux8.10 - KVM: s390: Limit adapter indicator access to mapped page JIRA:AlmaLinux-18388...

ALSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

thrift: Apache Thrift Node.js bindings: Denial of Service due to inefficient algorithmic complexity and resource allocation

A flaw was found in Apache Thrift Node.js bindings. This vulnerability, stemming from inefficient algorithmic complexity and the allocation of resources without proper limits or throttling, allows a remote attacker to cause a Denial of Service DoS. By exploiting this, an attacker can consume...

SUSE CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readOpaque method of MLSInputStream, which decodes a varint length up to 0x3FFFFFFF about 1 GiB and calls readAllsize performing new bytesize before checking that enough bytes remain in...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readOpaque method of MLSInputStream, which decodes a varint length up to 0x3FFFFFFF about 1 GiB and calls readAllsize performing new bytesize before checking that enough bytes remain in...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L fro...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L fro...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from an encoded public key without the RFC 8554 depth cap of 8 enforced only during key...