CVE-2024-12886 Out-Of-Memory (OOM) Vulnerability in ollama/ollama

An Out-Of-Memory OOM vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and...

CVE-2024-12886 Out-Of-Memory (OOM) Vulnerability in ollama/ollama

An Out-Of-Memory OOM vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and...

CVE-2024-12886

CVE-2024-12886 affects ollama/ollama up to version 0.3.14 with an Out-Of-Memory (OOM) DoS when a gzip bomb is processed. The root cause is reading the response body via io.ReadAll in makeRequestWithRetry and getAuthorizationToken, leading to excessive memory usage and crash. Multiple sources (NVD...

CVE-2025-29786

A flaw was found in Expr. This vulnerability allows excessive memory usage and potential out-of-memory OOM crashes via unbounded input strings, where a malicious or inadvertent large expression can cause the parser to construct an extremely large Abstract Syntax Tree AST, consuming excessive...

CVE-2025-29786

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

CVE-2025-29786

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

CVE-2025-29786 Memory Exhaustion in Expr Parser with Unrestricted Input

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

Linux Distros Unpatched Vulnerability : CVE-2024-47874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starlette is an Asynchronous Server Gateway Interface ASGI framework/toolkit. Prior to version 0.40.0, Starlette treats multipart/form-data parts without a...

Linux Distros Unpatched Vulnerability : CVE-2022-41717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by th...

Linux Distros Unpatched Vulnerability : CVE-2017-15996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service excessive memory allocation or possibly have unspecified other...

Linux Distros Unpatched Vulnerability : CVE-2018-12698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - demangletemplate in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption aka OOM during t...

Linux Distros Unpatched Vulnerability : CVE-2017-14938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bfdelfslurpversiontables in elf.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a...

SUSE SLED15: skopeo / skopeo-bash-completion / skopeo-fish-completion / etc (SUSE-SU-2025:0772-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0772-1 advisory. - CVE-2025-27144: excessive memory consumption by Go JOSE when parsing compact JWS or JWE input containin...

Denial Of Service (DoS)

github.com/go-jose/go-jose is vulnerable to Denial Of Service DoS. The vulnerability is due to improper token parsing using strings.Splittoken, ".", which fails to limit the number of splits, allowing attackers to create excessively large token segments that consume excessive memory...

DoS in go-jose Parsing

Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Splittoken, "." to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could...

CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2024-4140

An excessive memory use issue CWE-770 exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set from 2020 and 2024 limits excessive depth and the total number of parts...

Excessive Memory Consumption

github.com/t2bot/matrix-media-repo is vulnerable to Excessive Memory Consumption. The vulnerability is due to inadequate handling of large JSON responses, allowing an attacker to exhaust system memory and potentially crash the application...

PT-2025-30831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where insufficient validation of the RAS header read from EEPROM could lead to excessive memory allocation when the header is corrupted. This can occur...

CBL Mariner 2.0 Security Update: binutils (CVE-2022-48063)

The version of binutils installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-48063 advisory. - GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the...