PT-2026-110117

Name of the Vulnerable Software and Affected Versions MCP Kotlin SDK versions prior to 0.15.1 Description An uncontrolled memory allocation issue exists because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Remote clients can exploit this by sending small frame...

CVE-2026-108683: Memory Allocation with Excessive Size Value

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2026-108714: Allocation of Resources Without Limits or Throttling

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB...

CVE-2026-97853

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

EUVD-2026-96426

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

CVE-2026-97853 Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

Denial-of-service (DoS)

github.com/luskaner/agelanserver/server is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of request body size limits and validation of the attacker-controlled JSON array length, which allows a remote unauthenticated attacker to trigger excessive memory allocation by...

PT-2026-109865

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

CVE-2026-97853: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...

Linux Distros Unpatched Vulnerability : CVE-2026-108106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary spdystream is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-35469. Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame...

github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulti...

CVE-2026-108106

A flaw was found in snappy-java. A remote attacker can exploit this unbounded memory allocation vulnerability by providing crafted compressed input with an excessively large declared uncompressed size during decompression. Successful exploitation allows the attacker to exhaust available system...

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

CVE-2026-107839

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

EUVD-2026-95934

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107839

The ageLANServer software, which provides a cross-platform web server and launcher for Age of Empires and Age of Mythology games, is vulnerable to a Remote Denial of Service (DoS) . In versions prior to 1.15.2 , the AoE3 POST /game/cloud/getFileURL handler lacks a request body size limit and fail...

DEBIAN-CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...