Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Bouncy Castle for Java. Bouncy Castle is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-12185...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple BouncyCastle vulnerabilities (CVE-2026-13506, CVE-2026-14682)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD uses bouncy-castle to parse and load PEM format certs. CVE-2026-13506, CVE-2026-14682. Vulnerability Details CVEID:CVE-2026-13506 DESCRIPTION: In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the EBML element parser in EbmlIterator.ts, where an attacker-controlled element length...

Memory Allocation with Excessive Size Value

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the LZ4DecompressorWithLength.decompress process. An attacker can cause excessive...

Astra Linux – Vulnerability in Apache2

A memory allocation vulnerability with an excessive size value in Apache HTTP Server’s modhttp leads to a denial of service due to malicious HTTP requests. This issue affects Apache HTTP Server versions 2.4.17 through 2.4.67...

Linux Distros Unpatched Vulnerability : CVE-2026-82458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang,...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91366

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...

Memory Allocation with Excessive Size Value

Overview org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol is an AMQP 0-8, 0-9 and 0-9-1 protocol broker plug-in. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to improper handling of type size and count in the AMQP 0-8/0-9/0-9-1 decoder. ...

EulerOS 2.0 SP10 : mod_http2 (EulerOS-SA-2026-3705)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the Reserve process. An attacker can exhaust system memory and cause service disruption by sending a multipart upload request with a large declared part size in the request headers, without...

CVE-2026-83530: Memory Allocation with Excessive Size Value

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

EulerOS 2.0 SP12 : mod_http2 (EulerOS-SA-2026-3283)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests...

Memory Allocation with Excessive Size Value

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the size parameter. An attacker can cause memory exhaustion and terminate the node...

CVE-2026-72645 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memor...

CVE-2026-72678

CVE-2026-72678 : Elasticsearch vulnerability where a user-controlled size value is not validated before memory reservation, enabling memory exhaustion. An authenticated user with read privileges can send a single crafted request to a REST API endpoint, causing the node to attempt an excessively l...

CVE-2026-72656: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amou...

CVE-2026-61485

Rejected reason: this attack requires control over the search index, which is considered fully trusted by Lucy...

EUVD-2026-53190

UNSUPPORTED WHEN ASSIGNED Memory Allocation with Excessive Size Value vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access ...