Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause...

php-cve-2026-10961x-lab-poc

php2shell lab — PHP CVE-2026-109618 / CVE-2026-109619 Lab reproduction and vulnerability-research package for the PHP 8.5.11 php2shell class CVE-2026-109618, CVE-2026-109619, October 2026. Status: Proven — self-contained RCE four plain HTTP requests, no debugger, no local access, plus...

CVE-2026-96638

The Pillow Python imaging library (versions 9.1.0 through 13.0.0 ) is vulnerable to a memory-exhaustion denial of service due to a flaw in the BmpRleDecoder.decode() function located in src/PIL/BmpImagePlugin.py. The root cause is the lack of a per-branch cap on crafted RLE BMP delta escapes and ...

CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-101896

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty...

tornado: Tornado: Denial of Service via memory amplification in multipart parsing

A flaw was found in Tornado. This memory amplification vulnerability exists in the parsemultipartformdata function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-3176)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3176 advisory. Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart reques...

Important: python3-tornado

Issue Overview: Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and...

Important: python-tornado

Issue Overview: Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and...

Important: python-tornado

Issue Overview: Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and...

Important: python3.13-tornado

Issue Overview: Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and...

Amazon Linux 2 : python3-tornado (ALAS-2026-3975)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3975 advisory. Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data...

TencentOS Server 4: pcs (TSSA-2026:1077)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1077 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-3177)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3177 advisory. Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart reques...

Amazon Linux 2 : python-tornado (ALAS-2026-3976)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3976 advisory. Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data befo...

PT-2026-109285

Name of the Vulnerable Software and Affected Versions ageLANServer versions prior to 1.15.2 Description The bundled game server in ageLANServer contains a remote denial-of-service issue. The POST /game/cloud/getFileURL endpoint fails to limit the request body size or the number of elements in the...

CVE-2026-97031

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...

Oracle Linux 8 : dovecot (ELSA-2026-76763)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76763 advisory. - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation RHEL-251995 - fix CVE-2026-42007: heap use-after-free in...

Denial Of Service (DoS)

@angular/router is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient handling of numeric matrix parameter and outlet names that causes excessive memory allocation for JavaScript objects, which allows a remote attacker to craft malicious URLs that trigger significant...