EUVD-2026-116585

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-120650

The perl-cgi module (versions before 5.00 ) is vulnerable to a Denial of Service (DoS) attack due to the allocation of resources without limits or throttling (CWE-770). The root cause is the missing or unenforced enforcement of request size, parameter, and upload limits. Specifically, $CGI::POST_...

CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore versions before 4.3.0 are vulnerable to an integer underflow in HTTP request body handling. This flaw allows unauthenticated attackers to bypass the http_body_max limit by sending more body bytes than declared. By sending oversized first segments over multiple concurrent POST , PUT , or DELE...

CVE-2026-63501

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

CVE-2026-121405

A flaw was found in FreeRDP. When serial device redirection is enabled, a malicious Remote Desktop Protocol RDP server can send a crafted serial device-control request specifying an excessively large output buffer length. Because FreeRDP fails to limit this buffer length before allocating memory,...

CVE-2026-121399

A flaw was found in FreeRDP. A malicious Remote Desktop RD Gateway server can trigger a Denial of Service DoS by sending a specially crafted packet header with an excessively large declared length prior to authentication. This causes the client to allocate an excessive amount of system memory,...

CVE-2026-63501 ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

CVE-2026-63501

The ag-psd JavaScript library for Photoshop Document files is vulnerable to uncontrolled memory allocation in the PSD layer decoding process. Prior to version 31.0.3 , the readPsd() function fails to correctly pass the totalMemoryLimit to decodeLayerImageData because it expects a differently name...

EUVD-2026-116262

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

CVE-2026-121412

A flaw was found in FreeRDP. This vulnerability allows an authenticated remote client to cause a Denial of Service DoS by exhausting system memory on the proxy server. When intercepting Dynamic Virtual Channel DVC communications, the proxy does not enforce cumulative limits on reassembling...

CVE-2026-106121

A flaw was found in the RabbitMQ Java client library. When parsing incoming JSON-formatted messages, the built-in parser fails to terminate correctly if an input ends abruptly within an unclosed string or comment. A remote attacker could send a specially crafted, truncated message to trigger an...

CVE-2026-115716

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-115716 Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

EUVD-2026-116081

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-115716

The APM Server is vulnerable to a Denial of Service (DoS) due to Allocation of Resources Without Limits or Throttling (CWE-770) . An attacker can send Oversized Serialized Data Payloads (CAPEC-231) via OpenTelemetry (OTLP) data over HTTP , causing the server to exhaust its memory and terminate. T...

APM Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-236)

Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP da...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-235)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of t...

CVE-2026-108147 Potential memory exhaustion in MultiPartParser via base64-encoded file upload

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...