EUVD-2026-49042

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...

CVE-2026-66011

ImageMagick before 7.1.2-27 contains a memory leak in the magick command-line interface triggered by invalid options. Repeatedly supplying malformed command-line arguments can exhaust memory, potentially impacting system resources. Affected software: ImageMagick (CLI component) prior to 7.1.2-27....

EUVD-2026-49003

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Summary expand bounds the number of results it produces the max option, 100000 by default but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate...

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead ...

DEBIAN-CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

EUVD-2026-48739

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...

CVE-2026-5079

A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The...

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Summary The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments whil...

GHSA-4W2J-M93H-CJ5J Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Summary The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments whil...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142 Apache Neethi: Uncontrolled recursion in policy processing

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66142

Apache Neethi is affected by uncontrolled recursion when parsing policies that lack policy IDs or that have deeply nested structures, potentially causing a denial of service through runtime memory exhaustion. The issue affects the Neethi policy processing component and is mitigated by upgrading t...

OESA-2026-3164 gawk security update

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code. Security Fixes: Use After Free vulnerability has been found in "io.c" program file of...

OESA-2026-3159 perl-Mojolicious security update

Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the...