CVE-2026-48824

Mailpit versions before 1.30.1 expose a pre-auth memory-exhaustion DoS via unbounded JSON bodies on four endpoints: PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release. The root cause is json.NewDecoder(r.Body) used without a body-size cap, unlik...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the json.NewDecoder process in multiple API endpoints that lack a body-size cap. An attacker can exhaust system memory and cause service disruption by sending large, unbounded JSO...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the json.NewDecoder process in multiple API endpoints that lack a body-size cap. An attacker can exhaust system memory and cause service disruption by sending large, unbounded JSO...

CVE-2026-35034

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint POST /SyncPlay/New, where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By...

EUVD-2026-32583

bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler and similarly webHandlerTelegramBot processes user-provided JSON payloads by directly using json.NewDecoderr.Body.Decode&request without restricting the maximum read size. An unauthenticated remote attacker can stream an...

Denial Of Service (DoS)

Servify Express is vulnerable to Denial of Service DoS. The vulnerability is due to the use of express.json without a request size limit, which allows an attacker to send extremely large JSON request bodies that exhaust memory or resources, leading to degraded performance or application crashes...