TomcatKiller-CVE-2025-31650

TomcatKiller-CVE-2025-31650 A tool designed to detect the vulnerability CVE-2025-31650 in Apache Tomcat versions 10.1.10 to 10.1.39 This vulnerability allows an attacker to trigger a memory leak by sending specially crafted HTTP/2 requests with invalid priority headers, leading to a...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Core

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-89425 DESCRIPTION: UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the...

Uncontrolled Resource Consumption

io.netty, netty-codec-http3 is vulnerable to uncontrolled resource consumption. The vulnerability is due to improper validation and lack of size limits on QPACK encoder-stream string literals, which allows a remote unauthenticated attacker to exhaust server heap memory and trigger an...

com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

CVE-2026-113604

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec...

CVE-2026-113604

Ghidra versions 10.2 through 12.1.4 are vulnerable to a Denial of Service (DoS) condition within the ELF loader's ElfHeader class . The root cause is the allocation of arrays using unvalidated extended section and program header counts . An attacker can provide a crafted 128-byte ELF file that tr...

CVE-2026-113604 Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec...

EUVD-2026-105082

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec...

CVE-2026-113604 Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec...

Atlassian Jira Service Management Data Center and Server 3.0.x < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16837)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16837 advisory. - jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption...

Linux Distros Unpatched Vulnerability : CVE-2026-110257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from...

Linux Distros Unpatched Vulnerability : CVE-2026-110260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS...

DoS (Denial of Service) org.jsoup:jsoup Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.4.23, 10.2.6, and 10.4.2 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated...

DoS (Denial of Service) org.jsoup:jsoup Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.24, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows...

DoS (Denial of Service) org.jsoup:jsoup Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.24 and 11.3.9 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacke...

DoS (Denial of Service) org.jsoup:jsoup Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.2.22 and 12.1.10 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

Apache MINA Vysper 0.7 Unbounded XML Buffer Pre-Auth DoS

Summary Apache Vysper is an XMPP eXtensible Messaging and Presence Protocol server, also known as Jabber, designed to run stand-alone or embedded in another application and work with any compliant XMPP client. Description Apache MINA Vysper is an XMPP server that suffers from a remote,...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-102466

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x MySQL client vertx-mysql-client pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an...