CVE-2026-69249: Uncontrolled Resource Consumption

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

axios formDataToJSON DoS

The vulnerability of the formDataToJSON function in the axios library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GHSA-FQJ3-H9PC-443H Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mwf2-3pr3-8698. This link is maintained to preserve external references. Original Description axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request...

Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mwf2-3pr3-8698. This link is maintained to preserve external references. Original Description axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

SUSE CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

CVE-2026-67318: Uncontrolled Resource Consumption

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-53505: Uncontrolled Resource Consumption

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2026-55497: Uncontrolled Resource Consumption

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded...

CVE-2026-52857: Uncontrolled Resource Consumption

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

Unbound DNS Resource Exhaustion DoS

The vulnerability of the Unbound DNS server is related to excessive resource consumption during the cycle. Exploiting this vulnerability allows a malicious actor to cause service failures...

Dulwich Git Uncontrolled Resource Consumption DoS

The vulnerability of the Python library for working with Git repositories in Dulwich is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

JavaScript Serialization Uncontrolled Resource Consumption DoS

The vulnerability of the library for serializing JavaScript objects into a string format is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Bouncy Castle Java FIPS DoS

The vulnerability of Java Cryptographic Libraries, specifically Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS, is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow attackers to cause service failures...

Grafana Monitoring Resource Consumption DoS

The vulnerability of the Grafana monitoring and observation platform is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2026-53504: Uncontrolled Resource Consumption

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service. Vulnerability Details CVEID:CVE-2026-9171 DESCRIPTION: IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerabl...

JLSEC-2026-911

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service memory consumption in Magick::Draw...

CVE-2026-11897 IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...