CVE-2026-110260

A flaw was found in OW2 ASM. An attacker can trigger a Denial of Service DoS by providing a specially crafted Java class file containing numerous overlapping exception handlers. When the library analyzes the method stack or frame structures of such a file, it performs excessive memory allocation,...

CVE-2026-110257

A flaw was found in OW2 ASM. An attacker can cause a Denial of Service DoS by providing a specially crafted Java class file. Due to missing attribute length validation during class parsing, processing the file triggers excessive memory allocation, exhausting system resources and crashing the...

CVE-2026-98518

A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service DoS or system instability through an out-of-bounds memory access in video random-access memory VRAM. The issue occurs because the driver fails to allocate an...

CVE-2026-98454

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious SMB server can exploit this vulnerability by sending malformed create context responses to a connecting system. Because the client fails to properly validate record boundaries during response parsing, this issue c...

CVE-2026-98452

A flaw was found in the Linux kernel's Server Message Block SMB client. When opening cached directories, the client fails to validate server responses to compound commands before reading their contents and handling file identifiers. A malicious or compromised SMB server could exploit this flaw by...

CVE-2026-98522

A flaw was found in the Linux kernel's Imagination PowerVR GPU driver. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the system. The issue occurs when the driver fails to properly return an error code after a memory mapping failure, allowing execution to...

CVE-2026-98463

A flaw was found in the Linux kernel's schedext extensible scheduler subsystem. Improper handling of wakeup enqueue flags during remote task activation can cause a deferred action request to remain pending after the scheduler is disabled. When a new scheduler initializes and processes deferred...

CVE-2026-10758

A flaw was found in LERC. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by submitting specially crafted image data to an application using the library. Processing the malicious input triggers an integer overflow that leads to an out-of-bounds memory...

CVE-2026-98515

A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service DoS by crashing the system or potentially escalate privileges. During device initialization failures, the driver's error-handling path executes redundant cleanup...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.jsoup:jsoup Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.2 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

CVE-2026-12670

IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion...

CVE-2026-11831

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request...

DEBIAN-CVE-2026-111061

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-111061

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-10743

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket reader aiohttp/websocket/readerpy.py accumulating an unbounded number of per-read payload fragments in memory. An attacker can send a large number of tiny WebSocket...

GHSA-4WC5-F2RC-Q74M russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

Summary russhkeys::agent::server::addkey russh/src/keys/agent/server.rs:271-319 spawns a dedicated tokio task for every 5-byte SSHAGENTCONSTRAINLIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime up to 136 years. The loop has no per-request...