11 matches found
CVE-2026-106453
A flaw was found in lz4-java. The library trusts the decompressed length header in compressed input before validating the input data, leading to uncontrolled memory allocation. A remote attacker can exploit this vulnerability by supplying a specially crafted input that specifies an excessively...
CVE-2026-59274
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...
CVE-2026-59274: Improper Handling of Highly Compressed Data (Data Amplification)
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...
Denial Of Service
Jackson Core is vulnerable to Denial Of Service. The vulnerability is due to NonBlockingUtf8JsonParserBase failing to enforce maxNumberLength when a non-blocking JSON number remains in MINORNUMBERINTEGERDIGITS across input chunks, allowing an attacker to exhaust JVM heap memory through repeated o...
GHSA-65R4-943X-97JJ jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...
CVE-2026-75140
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...
PT-2026-98971
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...
CVE-2026-75140: Allocation of Resources Without Limits or Throttling
jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...
Denial Of Service (DoS)
Apache IoTDB is vulnerable to Denial Of Service DoS.The vulnerability is due to missing authentication and insufficient validation of attacker-controlled allocation sizes in the AirGap receiver, allowing unauthenticated attackers to trigger excessive memory allocation and exhaust JVM heap memory,...
Denial Of Service (DoS)
Apache Fluss is vulnerable to Denial Of Service DoS. The vulnerability is due to configuring Netty's LengthFieldBasedFrameDecoder with an excessively large maximum frame length, which allows an unauthenticated remote attacker to send crafted frame headers and exhaust JVM heap memory on the...
