CVE-2026-13056: Improperly Controlled Sequential Memory Allocation

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error...

Important: Red Hat Security Advisory: libtiff security, bug fix, and enhancement update

An update for libtiff is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-45713: Uncontrolled Resource Consumption

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

RHEL 10 : libtiff (RHSA-2026:41892)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41892 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff:...

Loki detected_fields query limits results in unbounded memory allocation

The Loki detectedfields endpoint allocates 2limit elements in slices and maps based on the user-supplied limit query parameter, regardless of actual result count. A massive limit value e.g. 600000000 allocates 20-30 GiB even with zero matching results, causing OOM, resulting in denial of service...

AZL-92402 CVE-2026-15713 affecting package libsoup 3.4.4-16

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

AZL-92411 CVE-2026-15709 affecting package libsoup 3.4.4-16

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

CVE-2026-15709: Improper Handling of Highly Compressed Data (Data Amplification)

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

CVE-2026-15713: Missing Release of Resource after Effective Lifetime

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...

PT-2026-60082

Name of the Vulnerable Software and Affected Versions Hoverfly version 1.12.7 Description Remote post-serve actions use http.DefaultClient without a timeout configuration. When a remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks...

PT-2026-60046

Impact DNSIncoming. log exception debug and the four QuietLogger exception-dedup methods stored an unbounded seen logs dict keyed by strsys.exc info1. The seven IncomingDecodeError messages raised from read name / decode labels at offset RFC 6762 §18 name-decoding error paths all embed self.sourc...

PT-2026-79474

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.124.0 through 0.141.0 Description An unauthenticated client can trigger a denial of service by sending a query with sparse indexes in a deepObject query parameter to an endpoint whose schema contains an array. The functi...

OESA-2026-2894 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

PT-2026-59762

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow: python import tensorflow as tf tf.raw ops.StringNGrams data='123456', data splits=0,1, separator='a'15, ngram widths=, left pad='', right pad='', pad...

PT-2026-60052

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

CVE-2026-59939: Improper Handling of Highly Compressed Data (Data Amplification)

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

OPENSUSE-SU-2026:21265-1 Security update for cadvisor

This update for cadvisor fixes the following issues: Changes in cadvisor: - update to 0.60.3: Move OOM watching out of the lib module into the binary lib/model: make ContainerStats sub-stats pointers to convey collection presence - update to 0.60.1: cpuload/netlink: report the real error and skip...

AZL-90176 CVE-2026-47262 affecting package containerd2 for versions less than 2.2.4-3

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an...

AZL-91782 CVE-2026-47262 affecting package moby-containerd-cc 1.7.7-17

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an...

CVE-2026-47262

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an...