TomcatKiller-CVE-2025-31650

TomcatKiller-CVE-2025-31650 Инструмент для обнаружения уязвимости CVE-2025-31650 в Apache Tomcat версии 10.1.10 - 10.1.39 Эта уязвимость позволяет атакующему вызвать утечку памяти , отправляя специально сформированные HTTP/2 запросы с недопустимыми заголовками приоритета, что приводит к отказу в...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-59295

A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

BIT-KEYCLOAK-2026-2575 Keycloak: keycloak: denial of service due to excessive samlrequest decompression

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...

Astra Linux – Vulnerability in Tomcat9

The “Allocation of Resources Without Limits or Throttling” vulnerability in Apache Tomcat exists. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, and from 9.0.13 through 9.0.89. The following versions were already end-of-life at the tim...

EUVD-2026-64774

Micrometer-instrumented Apache HttpAsyncClient 4.x or 5.x usage via MicrometerHttpClientInterceptor can leak memory unboundedly when asynchronous requests fail before receiving a response e.g. connection resets or timeouts. Tracking state for these requests remains in memory indefinitely, and...

CVE-2026-59323

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12...

EUVD-2026-63882

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: The application...

CVE-2026-59323 Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12...

CVE-2026-59323

CVE-2026-59323 is a denial-of-service vulnerability in io.micrometer:micrometer-tracing-bridge-brave caused by unbounded object allocation when parsing W3C baggage headers. Incoming baggage entries are processed without enforcing limits on entry count or header size, leading to unconditional Bagg...

Linux Distros Unpatched Vulnerability : CVE-2026-75140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to...

CVE-2026-54389

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

EUVD-2026-63746

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-54389 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-54389 Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

PT-2026-79259

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters int...

CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-75841

ArcadeDB versions before 26.8.1 are vulnerable in the Cypher range() function: authenticated users can submit oversized range() expressions with large bounds, exhausting heap memory and triggering OutOfMemoryError, causing temporary service degradation. CVSS 3.1 base score is 4.3 (MEDIUM). No pub...