CVE-2025-43960

CVE-2025-43960 - Adminer Adminer のクラッシュが他のサービス/テナント 例: コンテナや共有プロセス にも影響を与える場合、スコープ: 変更 が適用される可能性があります: ベクター: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H スコア: 8.6 High 追加情報 潜在的な緩和策 Adminer および Monolog 内で信頼できないデータに対して unserialize を使用しない。 PHP でメモリ制限 memorylimit を適用し、過剰なリソース消費を防ぐ。 unserialize で allowedclasse...

GO-RPCBOMB

説明: CVE-2017-8779 rpcbind 0.2.4 以前、LIBTIRPC 1.0.1 以前および 1.0.2-rc から 1.0.2-rc3 まで、NTIRPC 1.4.3 以前は、XDR 文字列のメモリ割り当て時に最大 RPC データサイズを考慮しません。このため、リモートの攻撃者が細工した UDP パケットをポート 111 に送信することで、サービス拒否（その後の解放を伴わないメモリ消費）を引き起こす可能性があります。別名 rpcbomb と呼ばれます。 CVE リンク https://vulners.com/cve/CVE-2017-8779 インストール手順 前提条...

CVE-2017-7472

CVE-2017-7472 Linux内核4.10.13之前版本的KEYS子系统允许本地用户通过一系列KEYREQKEYDEFLTHREADKEYRING keyctlsetreqkeykeyring调用导致拒绝服务（内存消耗）。 快捷方式 受影响 内核 4.10.13...

CVE-2007-5962

CVE-2007-5962 1. Introduction My tool is written in Python and exploits the CVE-2007-5962 vulnerability to perform a series of directory changes that crash the ftp daemon. root@kitploit: DISCLAIMER!!! Please note that the use of hacking tools without authorization is illegal and could result in...

CVE-2026-19475

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

EUVD-2026-70104

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

GHSA-23W6-3W8W-8484 pypdf: Possible long runtimes/large memory usage when retrieving outlines

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. Patches This has been fixed in pypdf==6.16.1...

GHSA-763M-79HH-57F2 pypdf: Possible long runtimes/large memory usage when extracting XForm objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. Patches This has been fixed in pypdf==6.16.1. Workarounds If you...

CVE-2026-84311

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF document containing specially structured XForm objects. Processing this document can lead to excessive iteration, causing the application to consume significant memor...

CVE-2026-56143

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node...

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

PT-2026-84463

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that leads to excessive memory consumption and long runtimes. This occurs when extracting text from a page containing numerous reused form XObjects, where a form invok...

CVE-2026-47874

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

Linux Distros Unpatched Vulnerability : CVE-2026-79921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process...

AZL-98201 CVE-2026-79921 affecting package keda 2.14.1-16

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...

PT-2026-82310

Name of the Vulnerable Software and Affected Versions amqp091-go versions prior to 1.13.0 Description A compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame max limit. This bypasses the protocol's...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range multiple times in a single HTTP request, causing the server to use large amounts of memory. This does not resul...

devalue: devalue: Excessive memory consumption via deserialization of sparse arrays

A flaw was found in devalue, a JavaScript library used for serializing values. Due to quirks in some JavaScript engines, the devalue.parse function could be exploited by a remote attacker when deserializing specially crafted sparse arrays. This could lead to excessive memory consumption, resultin...