CVE-2026-111252 OpenNMS denial of service via XML entity expansion

A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server...

CVE-2026-110601

A flaw was found in libsixel. This vulnerability allows an attacker to cause memory corruption and application crashes, resulting in a Denial of Service DoS, by tricking an application into processing a specially crafted GIF image. The issue occurs because the image parser fails to validate the...

CVE-2026-110603

A flaw was found in laszip. This invalid free vulnerability allows an attacker to cause a Denial of Service DoS and memory corruption by supplying a specially crafted LAS or LAZ file. When the application processes truncated Variable Length Record VLR data with an inflated record count, it attemp...

CVE-2026-110715

A flaw was found in MuJS. The JavaScript engine fails to properly validate array boundaries when sorting an array whose length property has been enlarged. By supplying specially crafted JavaScript code, an attacker can trigger out-of-bounds memory operations, potentially leading to memory...

CVE-2026-100350

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-73260

A flaw was found in Mongoose. The built-in Transport Layer Security TLS certificate parser fails to verify that element lengths fit within the remaining certificate buffer, leading to an out-of-bounds memory read. An unauthenticated remote attacker can exploit this vulnerability by presenting a...

CVE-2026-63626

A flaw was found in Mongoose. An unauthenticated adjacent attacker can exploit this issue by sending a specially crafted Point-to-Point Protocol PPP packet containing an oversized length field during IPv6 Control Protocol IPv6CP negotiation. This lack of bounds validation causes out-of-bounds...

CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

EUVD-2026-102315

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92707

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92707

The MessagePack-CSharp library is vulnerable to an improperly controlled sequential memory allocation (CWE-1325) when deserializing attacker-controlled data as System.Object via the PrimitiveObjectFormatter . The root cause is that the formatter allocates an object[] based on declared array lengt...

CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

GHSA-QHRR-8Q5H-9Q3H MessagePack: Nested arrays can blow past buffer length limits

Impact MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into System.Object. When PrimitiveObjectFormatter encounters an array, it allocates an object using the declared array length before enforcing the configure...

MessagePack: Nested arrays can blow past buffer length limits

Impact MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into System.Object. When PrimitiveObjectFormatter encounters an array, it allocates an object using the declared array length before enforcing the configure...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...