GHSA-QJ98-GP63-54XJ Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Summary Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable. The exposed routes include: - /state - /assign - /removeNode - /moveTablet An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks th...

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Summary Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable. The exposed routes include: - /state - /assign - /removeNode - /moveTablet An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks th...

EUVD-2026-100525

Vitess vttablet /twopcz reflected XSS...

GHSA-FH4F-47MF-F2GJ kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

Summary The openapi3filter.ValidationHandler the exported, documented request-validation middleware hard-wires the legacy router routers/legacy. That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

Summary The openapi3filter.ValidationHandler the exported, documented request-validation middleware hard-wires the legacy router routers/legacy. That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a...

GHSA-G4F2-2PF3-2PWJ react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

GHSA-524C-H47V-M3H8 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Description A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using router.matchers.slug on a route parameter reachable by an attacke...

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

Summary Sliver is vulnerable to a Denial of Service DOS attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server,...

GHSA-663M-7X7M-G4FW Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

Summary Sliver is vulnerable to a Denial of Service DOS attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server,...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) affected by an Uncontrolled Resource Consumption Vulnerability in Apache Tomcat (CVE-2026-68763)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD uses Apache Tomcat for its web interface and services. CVE-2026-68763. Vulnerability Details CVEID:CVE-2026-68763 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog trackin...

DEBIAN-CVE-2026-87029

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

DEBIAN-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

DEBIAN-CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

DEBIAN-CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...