CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...

CVE-2026-105270

Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...

CVE-2026-67226

A flaw was found in rabbitmq-server. An authenticated user with administrative privileges can cause a Denial of Service DoS by submitting user definitions containing an excessive number of unique tag names. Because the application converts each tag string into an internal Erlang identifier that...

CVE-2026-66073

A flaw was found in rabbitmq-server. An authenticated user with management API access can cause a Denial of Service DoS by sending requests containing arbitrary node names to queue, exchange, or binding endpoints. Because untrusted input is converted into internal system identifiers atoms without...

CVE-2026-94201

A flaw was found in ash. When filtering data using atom-typed attributes configured to permit string conversion, input values are converted into permanent internal symbols atoms that cannot be garbage-collected. A remote attacker can exploit this vulnerability by submitting queries with numerous...

CVE-2026-94201

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...

CVE-2026-94201

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...

EUVD-2026-92768

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...

PT-2026-106202

Name of the Vulnerable Software and Affected Versions ash versions 3.5.1 through 3.34.2 Description Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is used in a filter, the comparison value is processed through Ash.Type.Atom. Due to the absence of...

BIT-RABBITMQ-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...

BIT-RABBITMQ-2026-66073 RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

BIT-RABBITMQ-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

PT-2026-105158

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

PT-2026-105200

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...

EUVD-2026-89189

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

CVE-2026-102723

A NULL Pointer Dereference vulnerability exists in the software (related to Eclipse ThreadX/netxduo based on provided references) caused by MSRP Attribute Table Exhaustion . The vulnerability results in a high availability impact according to the CVSS 4.0 metric. No specific affected versions, ro...

CVE-2026-102723

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

CVE-2026-102723: NULL Pointer Dereference

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

SUSE CVE-2026-66073

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make -...

CVE-2026-67415

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...