CVE-2026-59323

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: The application...

EUVD-2026-63882

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: The application...

CVE-2026-59323 Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: The application...

CVE-2026-59323

CVE-2026-59323 is a denial-of-service vulnerability in io.micrometer:micrometer-tracing-bridge-brave caused by unbounded object allocation when parsing W3C baggage headers. Incoming baggage entries are processed without enforcing limits on entry count or header size, leading to unconditional Bagg...

Linux Distros Unpatched Vulnerability : CVE-2026-75140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to...

EUVD-2026-63746

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-54389 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-54389 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

PT-2026-79259

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-75841

ArcadeDB versions before 26.8.1 are vulnerable in the Cypher range() function: authenticated users can submit oversized range() expressions with large bounds, exhausting heap memory and triggering OutOfMemoryError, causing temporary service degradation. CVSS 3.1 base score is 4.3 (MEDIUM). No pub...

CVE-2026-75841 ArcadeDB before 26.8.1 Denial of Service via range()

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

GHSA-2QJ4-MMR9-4V2F Netty: Memory Exhaustion in SctpMessageCompletionHandler

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

EUVD-2026-57631

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

PT-2026-71347

Name of the Vulnerable Software and Affected Versions http4s-blaze-server versions prior to 0.23.18 http4s-blaze-server versions prior to 1.0.0-M42 Description The software aggregates fragments of incoming WebSocket messages without limiting the total size or the number of fragments. A client can...