Uncontrolled Resource Consumption

Bouncy Castle is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to allocating memory based on an attacker-controlled opaque length before performing bounds validation, which allows an attacker to trigger excessive memory allocation and potentially cause a...

SUSE CVE-2026-78701

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...

urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response,...

GO-2026-6275 kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the VideoMediaIO.mergekwargs and DeepStream video decoding paths in...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling unbounded resource growth due to osslackmontxpacket in ssl/quic/quicackm.c and txppktcommit in ssl/quic/quictxp.c. A remote peer can exhaust memory by completing a QUIC handshake and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through osslcmpmsgcheckupdate in crypto/cmp/cmpvfy.c. An attacker can drive unbounded memory growth by repeatedly sending CMP messages with unique extraCerts that are rejected during...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, CVE-2026-15057, CVE-2026-11897, CVE-2026-10842, CVE-2026-9563, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171,...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325, CVE-2026-15057, CVE-2026-11897, CVE-2026-10842, CVE-2026-9563, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171,...

AZL-97938 CVE-2026-63075 affecting package openssl for versions less than 3.3.7-6

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

ALPINE-CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

AZL-97944 CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075

The OpenSSL QUIC stack is vulnerable to a memory exhaustion Denial of Service (DoS) (CWE-770). When a remote peer completes a QUIC handshake and repeatedly sends ack-eliciting packets (such as PING frames ) while withholding acknowledgments for ACK-only responses , the OpenSSL implementation impr...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...