CVE-2026-69664

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

EUVD-2026-69238

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...

CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

EUVD-2026-69226

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Regular Expression Denial of Service.

Summary brace-expansion is used by IBM Storage Fusion Data Foundation, which could cause Regular Expression Denial of Service. CVE-2026-13149, CVE-2026-33750. Vulnerability Details CVEID:CVE-2026-33750 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix...

Security Bulletin: Security vulnerability affects IBM® SDK, Java™ Technology Edition (CVE-2026-71054)

Summary Security vulnerability has been addressed in IBM® SDK, Java™ Technology Edition. Vulnerability Details CVEID:CVE-2026-71054 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of...

CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

CVE-2026-70399

Erlang/OTP inets httpd contains a denial-of-service vulnerability (CVSS 4.0: 8.7 HIGH ). The accept gate in httpd_manager:handle_new_connection/4 reads max_clients via httpd_util:lookup/2, which returns undefined when the key is absent instead of the documented default of 150. Because Erlang term...

CVE-2026-70399

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

EEF-CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Summary Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets...

Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime (CVE-2026-70906, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, CVE-2026-16440)

Summary This bulletin for IBM Semeru Runtime covers all applicable Java SE CVEs published by OpenJDK as part of their August 2026 Vulnerability Advisory, plus one additional vulnerability. For more information please refer to OpenJDK's August 2026 Vulnerability Advisory and the CVE links below...

CVE-2024-10085

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform...

SUSE CVE-2026-72324

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irqallocdomaingenericchips allocates generic chip data that must be freed via irqdomainremovegenericchips. The devres action mvebugpioremoveirqdomain only called irqdomainremove, which on...

CVE-2024-10085

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform...

EUVD-2024-55737

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform...