25 matches found
CVE-2026-108859: Allocation of Resources Without Limits or Throttling
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll befor...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded request body reads in the Kubernetes admission webhook handler in dataclients/kubernetes/admission/admission.go. An attacker can exhaust memory and OOM-kill the skipp...
CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...
EUVD-2026-77618
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...
CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...
CVE-2026-57497
webtransport-go (a Go implementation of the WebTransport protocol in the quic-go project) is vulnerable to a memory exhaustion attack prior to version 0.11.1 . The function Session.parseNextCapsule() in session.go calls io.ReadAll on the capsule reader, retaining the full declared capsule body in...
CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...
CVE-2026-53716: Memory Allocation with Excessive Size Value
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...
CVE-2026-57497: Allocation of Resources Without Limits or Throttling
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...
EUVD-2026-58135
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-42931
The Gitea application is vulnerable to a Denial of Service (DoS) attack due to the use of Unbounded io.ReadAll in the NPM Package Tag Endpoint . This vulnerability allows for the allocation of resources without limits or throttling, potentially leading to service exhaustion. Users are encouraged ...
CVE-2026-42931 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-42931
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-42931 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-42931: Allocation of Resources Without Limits or Throttling
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-73232
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...
CVE-2026-14539
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...
CVE-2026-14539: Allocation of Resources Without Limits or Throttling
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...
