CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

A flaw was found in Kore. An unauthenticated remote attacker can trigger an integer underflow in the HTTP request body handling mechanism by sending more body data than declared in the request header. This flaw allows the attacker to bypass configured maximum body size restrictions, resulting in...

Linux Distros Unpatched Vulnerability : CVE-2026-121727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sendi...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-63655

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) attack in versions prior to 4.3.1 . The vulnerability exists because the HTTP mode accepts unauthenticated POST /mcp requests and accumulates request-body chunks into...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

EUVD-2026-116585

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

DEBIAN-CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

UBUNTU-CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

Joris Vink core numeric error vulnerability

Versions of Joris Vink prior to 4.3.0 contain a numeric error vulnerability. This vulnerability stems from an integer underflow in HTTP request body processing. Unauthenticated attackers can bypass httpbodymax by sending a request body exceeding its declared length, causing contentlength to wrap...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/node is a Model Context Protocol implementation for TypeScript - Node.js middleware Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

Model Context Protocol MCP Java SDK resource management error vulnerability

The Model Context Protocol MCP Java SDK has a resource management vulnerability. This vulnerability stems from Servlet-based SSE, Streamable HTTP, and Stateless server transports, which do not limit the maximum size of the HTTP request body when reading it into memory. This allows unauthenticated...

MikroTik RouterOS Before 7.24 Integer Underflow

MikroTik RouterOS versions before 7.24 contain a pre-authentication integer underflow in HTTP request body handling that can cause a web management service denial of service and may allow code execution...