CVE-2026-89425: Allocation of Resources Without Limits or Throttling

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-66080: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

PT-2026-97563

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the validate partitions function where it only verifies that the requested partition count is at least 1, withou...

CVE-2026-67235: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-18170

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

CVE-2026-18170 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

CVE-2026-18170

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to cause a denial of service . The root cause is the allocation of resources without limits or throttling . No specific exploit details or remediation instructions are pr...

CVE-2026-18170 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

CVE-2026-93752

A flaw was found in CSSOM. This vulnerability allows a remote attacker to trigger a denial of service by providing a specially crafted stylesheet. The issue stems from improper validation of reserved property names within the CSSStyleDeclaration.setProperty function. Exploiting this, an attacker...

EUVD-2026-84004

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub...

CVE-2026-77322

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...

DEBIAN-CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-58268

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

UBUNTU-CVE-2026-59991

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-77322

The SIPGO library (prior to version 1.4.3 ) is vulnerable to a Denial of Service (DoS) attack via unvalidated WebSocket frame lengths. The root cause is located in sip/transport_ws.go, where WSConnection.Read creates a wsutil.Reader without setting the MaxFrameSize parameter. This allows an unaut...

CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-58268

The sipgo library (versions prior to 1.4.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) via an oversized Content-Length header. The vulnerability exists in the ParserStream.parseSingle function within sip/parser_stream.go, where the library allocates a SIP body buffer based on th...

CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...