CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana are vulnerable to an unbounded memory allocation issue. Because the application does not limit the request body size , authenticated users can trigger excessive memory consumption, potentially causing a server crash due to out-of-memory (OOM...

d_link_880_bug

Vulnerabilities in D-Link routers CVE-2017-14948 In this little write-up we will see some bugs I found on D-Link products. D-Link offers a wide range of products, including many different router models, mounting different firmware versions. In this document I will address the following firmware...

CVE-2026-109947

FreeRDP versions 3.20.1 before 3.32.0 are vulnerable to an uncontrolled resource allocation vulnerability within the drive_process_irp_read function. A malicious RDP server can exploit this by sending an IRP_MJ_READ request with a length of 0xffffffff , which leads to the exhaustion of client mem...

jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update is available for jackson-databind, jackson-modules-base, jackson-core, jackson-jaxrs-providers. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This is...

libheif-cve-2026-50142

CVE-2026-50142 — libheif Unbounded heap allocation in HEIF sequence parser stsz fixed-size mode Severity: High CVSS 7.5 Advisory: GHSA-jvmp-j3cw-84mh Fixed: commit a6caa38 by @farindk Time to fix: 1 hour Summary A 1,477-byte crafted HEIF file triggers 7 GB unchecked heap allocation in Chunk::Chun...

EUVD-2026-97433

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocessvideo in qwenvl.py that decodes frames at full source resolution before applying maxpixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and...

Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

Amazon Linux 2 : python-pip (ALAS-2026-3974)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3974 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers...

Important: python-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Important: python3.13-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Important: python3.12-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Important: python-urllib3

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Important: python3.11-pip

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc (crlsa-2026_77648)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202677648 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-3175)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3175 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...

Important: python-urllib3

Issue Overview: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigge...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-3172)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3172 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2026-3184)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3184 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-3174)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3174 advisory. urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser...