CVE-2026-110257

OW2 ASM 5.0 versions prior to 9.11 are vulnerable to an excessive memory allocation vulnerability within the ClassReader.readBootstrapMethodsAttribute() function. The root cause is the failure to validate attribute_length when sizing an int array from num_bootstrap_methods . An attacker can provi...

CVE-2026-110257 OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

EUVD-2026-101211

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110257 OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110257: Memory Allocation with Excessive Size Value

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

PT-2026-114023

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from num bootstrap methods without validating attribute length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110258: Memory Allocation with Excessive Size Value

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation...

BIT-ELASTICSEARCH-2026-103005 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an...

CVE-2026-107839

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the LZ4BlockInputStream process. An attacker can cause excessive memory allocation and exhaust system resources by supplying a crafted legacy LZ4Block stream with a large compressedLen val...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the LZ4BlockInputStream process. An attacker can cause excessive memory allocation and...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive memory allocation and trigger a denial of service by supplying a crafted input with a manipulated leng...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-185)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-185 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via...

RUSTSEC-2026-0322 Excessive allocated memory on the host when guests don't have stdio

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102504

A flaw was found in Imager. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying an out-of-range channel count parameter when reading raw image files. The application attempts an excessive memory allocation without validating the input, causing an unhandled allocati...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2024_1818)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241818 advisory. OpenJDK: long Exception message leading to crash 8319851 CVE-2024-21011 OpenJDK: integer overflow in C1 compiler address generation 8322122 CVE-2024-21068...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2022_7006)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227006 advisory. OpenJDK: excessive memory allocation in X.509 certificate parsing Security, 8286533 CVE-2022-21626 OpenJDK: HttpServer no connection count limit Lightweigh...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_3344)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253344 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...