26 matches found
CVE-2026-84364
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...
CVE-2026-84364
Hono is a JavaScript web application framework supporting any runtime. Prior to 4.13.5 , the parseBody() function, when dot-notation parsing is enabled, does not limit nesting depth or the number of intermediate objects created from dot-separated form field names. A single deeply dotted field nam...
CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...
CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects...
PT-2026-84502
Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.13.5 Description When dot-notation parsing is enabled, the parseBody function fails to limit the nesting depth or the total number of intermediate objects created when expanding dot-separated form field names into nest...
Astra Linux – Vulnerability in Apache2
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a Lua script that calls r:parsebody0 may cause a denial of service due to the lack of a default limit on the possible input size...
CVE-2026-56763
CVE-2026-56763 affects Hono prior to 4.12.7. The parseBody function with dot option enabled accepts proto in field names, allowing prototype pollution when parsed results are merged into regular objects via unsafe merge patterns. Impacted behavior includes modification of object prototypes and po...
Allocation of Resources Without Limits or Throttling
Overview @evomap/evolver is an A GEP-powered self-evolution engine for AI agents. Features automated log analysis and Genome Evolution Protocol GEP for auditable, reusable evolution assets. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling vi...
GHSA-W88C-9VG8-CMQ8 GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated...
CLSA-2023-1689009164 Fix CVE(s): CVE-2022-29404
SECURITY UPDATE: modlua may denial of service in r:parsebody0 - debian/patches/CVE-2022-29404.patch: use a liberal default limit for LimitRequestBody of 1GB to prevent a denial of service caused by a malicious lua script request - CVE-2022-29404...
httpd: mod_lua: DoS in r:parsebody
A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody0 can lead to a denial of service due to no default limit on the possible input size...
httpd: mod_lua: Use of uninitialized value of in r:parsebody
A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest threat from this vulnerability is to system availability...
httpd: mod_lua: Use of uninitialized value of in r:parsebody
A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest threat from this vulnerability is to system availability...
httpd: mod_lua: DoS in r:parsebody
A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody0 can lead to a denial of service due to no default limit on the possible input size...
httpd: mod_lua: DoS in r:parsebody
A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody0 can lead to a denial of service due to no default limit on the possible input size...
httpd: mod_lua: Use of uninitialized value of in r:parsebody
A flaw was found in the modlua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest threat from this vulnerability is to system availability...
The vulnerability of the mod_lua module in the Apache HTTP Server allows a hacker to cause a service failure.
The vulnerability of the modlua module in the Apache HTTP Server is related to the unlimited distribution of resources when processing the function with zero parameter r:parsebody0. Exploiting this vulnerability allows a malicious actor to cause service failures by sending a specially crafted HTT...
OESA-2022-1718 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to...
