Uncontrolled Resource Consumption

zstd-jni is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of negative length parameters in ZstdInputStreamNoFinalizer.read, which allows an attacker to trigger an infinite loop that holds the stream monitor and blocks other threads from accessing...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of JSON request bodies into memory despite the configurable input length limit, which allows an attacker to submit an oversized JSON request and exhaust the application's heap, causi...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of Content Security Policy violation reports into memory, which allows an unauthenticated attacker to submit an oversized report and exhaust the application's heap, causing a...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded growth of internal localized-text caches based on attacker-controlled locale values from incoming requests, which allows an unauthenticated remote attacker to exhaust the Java heap and cause a...

Inefficient Algorithmic Complexity

Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the linkify rule src/rulescore/linkify.ts via input containing multiple fuzzy links. The arrayReplaceAt utility was called repeatedly inside the...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

GHSA-R3PH-W7GJ-G6XM js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

CVE-2026-84784

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...

CVE-2026-54873

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data...

EUVD-2026-89081

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0...

DoS-Braces-3.03

CVE-Candidato: Denegación de Servicio en braces mediante Expansión de Llaves Separadas por Comas Paquete: braces npm Versión: 3.0.3 última Gravedad: ALTA CVSS 7.5 CWE: CWE-400 Consumo de Recursos No Controlado Estado: No reportado Nota: Este es un hallazgo independiente. CVE-2024-4068 abordó la...

Uncontrolled Resource Consumption

Bouncy Castle for Java is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded iteration counts in CRMF/CMP password-MAC processing, which allows an attacker to supply a maliciously high iteration count and cause excessive resource consumption, potentially...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pbkdf2 function in lib/sync.js, which passes the raw password to createHmac on every PBKDF2 iteration. Because HMAC rehashes any key longer than the digest's block size per RF...

CVE-2026-83530

A flaw was found in cel-go. A user can trigger a Denial of Service DoS by submitting an expression that exceeds the configured parser expression size limit. Because memory is allocated proportional to the input length before the limit is validated, processing oversized inputs causes uncontrolled...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the...

CLEANSTART-2026-QY36065 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

CLEANSTART-2026-UD61753 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the argo-workflows package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

Security Bulletin: Uncontrolled resource consumption, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to uncontrolled resource consumption, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-11822 DESCRIPTION: SQLite before 3.53.2 contains memory corruption vulnerabilities ...

The vulnerability in the collection of libraries used by the Content Credentials SDK, related to uncontrolled resource consumption, allows a perpetrator to cause a service failure.

The vulnerability of the Content Credentials SDK library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-100242: Dependency on Vulnerable Third-Party Component

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0...