UBUNTU-CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

EUVD-2026-85229

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Apache Tomcat is vulnerable to a Denial of Service (DoS) attack due to an uncontrolled resource consumption issue occurring during the sending of a WebSocket close message . The root cause is a busy wait condition that can be triggered by an attacker. This vulnerability affects versions 11.0.0-M5...

CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-81880

A flaw was found in radare2. The Apple Preferred Executable Format PEF loader in radare2 is vulnerable to uncontrolled resource consumption. A remote attacker could exploit this by providing a specially crafted Apple PEF file. The PEF loader accepts relocSecCount values that are not properly...

pgbouncer: PgBouncer: Denial of Service via unbounded SCRAM iteration count

A flaw was found in PgBouncer. A malicious or compromised PostgreSQL backend can exploit a missing upper bound on the key derivation iteration count during SCRAM Salted Challenge Response Authentication Mechanism authentication. This can lead to uncontrolled CPU consumption in PgBouncer,...

Unbounded Memory Consumption

Http4s is vulnerable to unbounded memory consumption. The vulnerability is due to HTTP/2 header blocks and CONTINUATION fragments being buffered without a size limit, which allows a remote attacker to keep an incomplete header block open and exhaust heap memory, potentially causing denial of...

CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-71418

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...

CVE-2026-63452

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. A remote attacker can exploit this vulnerability by sending repeated, small Brotli compressed responses to the HTTP/1 parser. This can cause the system to perform expensive decompression...

SUSE CVE-2026-19668

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through...

CVE-2026-91776: Uncontrolled Resource Consumption

TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfouse = Id.NAME, defaultImpl = ..., every distinct unrecognized type ID...

CVE-2026-67220: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, addbinding/3 reads the rjmserlangselector argument and passes it through erlscan:string/1 then erlparse:parseterm/1. erlscan:string/1 intern...

PT-2026-97504

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions 4.x through 4.3.0 Description The built-in less viewer in this Java library for console input passes user-controlled search and display-filter patterns from the getPatternboolean...

PT-2026-97390

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3 Description PgBouncer is subject to uncontrolled CPU consumption during SCRAM Salted Challenge Response Authentication Mechanism authentication to a backend server. This occurs because there is no upper bound...

PT-2026-97134

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind affected versions not specified Description Forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending-reference accumulator for every resolved ID. This occurs within the...

CVE-2026-14321: Uncontrolled Resource Consumption

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-67228: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...