CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

EEF-CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

EEF-CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856

ash_typescript (Elixir/BEAM library by ash-project) contains a resource-exhaustion flaw in resolve_typed_struct_field/2 within field_selector.ex. When a client-supplied field name on a typed struct field has no match in the reverse map, the code falls back to String.to_atom/1 before any field-exi...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

PT-2026-84162

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

ROS-20260901-73-0024

The vulnerability in MinIO is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

ROS-20260901-73-0023

The vulnerability in python-pyasn1 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0038

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0048

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ASB-A-430284594

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Alibaba Cloud Linux 3 : 0263: python-idna (ALINUX3-SA-2026:0263)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0263 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-45409: Internationalized Domain Names in...

AlmaLinux 10 : iperf3 (ALSA-2026:61680)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:61680 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

RockyLinux 9 : iperf3 (RLSA-2026:61389)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61389 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...