CVE-2026-59991: Memory Allocation with Excessive Size Value

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-58268: Memory Allocation with Excessive Size Value

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-18170: Allocation of Resources Without Limits or Throttling

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...

ROS-20260922-73-0133

The vulnerability in Python-Django is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python (UTSA-2026-090108)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090108 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacke...

SUSE CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

SUSE CVE-2026-93590

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded P2P KV offloading sessions in OffloadingConnector. Attackers can supply arbitrary...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...

CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...

CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct...

CVE-2026-62370

KubeEdge is vulnerable to an unbounded memory allocation in the pkg/viaduct/pkg/packer component. The Reader.Read function trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates memory before validating an upper bound. An authenticat...

Apache Qpid Proton-Dotnet: Apache Qpid Proton Dotnet: Denial of Service via excessive memory allocation

A flaw was found in Apache Qpid Proton Dotnet. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts. This could lead to excessive memory allocation, resulting in a denial of service DoS for the affected system...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...

org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service DoS, making the affected system unavailable to legitimate users...

netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory up to 32 MB per block before...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the absence of a total timeout in the remote policy fetch process. An attacker can cause the application to hang indefinitely by making a server respond extremely slowly, there...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

ROS-20260921-73-0104

The vulnerability of the 389 Directory Server catalog service server is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2026-85220: Allocation of Resources Without Limits or Throttling

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...