Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

Astra Linux – Vulnerability in Netty

In Netty 4.1.x before 4.1.46, the ZlibDecoders allowed unbounded memory allocation when decoding Zlib-encoded byte streams. An attacker could send a large Zlib-encoded byte stream to the Netty server, forcing the server to allocate all of its available memory to a single decoder...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before version 2.25.0 and before versions 2.16.9 LTS and 2.7.18 LTS. The calculations performed by mbedtlsmpiexpmod are not limited; therefore, providing overly large parameters could lead to a denial of service when generating Diffie-Hellman key pairs...

Astra Linux – Vulnerability in Tomcat9

Vulnerability of resource allocation without limits or throttling in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, and from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended...

CVE-2026-59323

A flaw was found in Micrometer Tracing's Brave bridge when using W3C baggage propagation. A remote attacker can exploit this by sending specially crafted requests with excessively large baggage headers. This can lead to unbounded memory allocation, causing high CPU usage, increased garbage...

Security update for rpcbind

This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

openSUSE 16 Security Update : wget (openSUSE-SU-2026:22011-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22011-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Tenable has extracted the...

UBUNTU-CVE-2026-97873

In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 PKCS5 scheme 1 and PKCS12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before...

Denial Of Service (DoS)

figlet.js is vulnerable to Denial Of Service DoS. The vulnerability is due to an unbounded loop when whitespaceBreak is enabled and the configured width is smaller than a rendered FIGlet character, which allows an attacker to trigger repeated processing that consumes excessive CPU and memory,...

Fedora 46 : baresip / libre (2026-b8539090fe)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-b8539090fe advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

Impact A denial-of-service infinite loop can occur in text / textSync when both: - whitespaceBreak: true is set, and - width is set smaller than the rendered width of a single FIGlet character. Under these conditions breakWord could never find a valid break point, so the word-wrapping loop in...

GHSA-62CH-8VMQ-8XM7 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

Impact A denial-of-service infinite loop can occur in text / textSync when both: - whitespaceBreak: true is set, and - width is set smaller than the rendered width of a single FIGlet character. Under these conditions breakWord could never find a valid break point, so the word-wrapping loop in...

EUVD-2026-91058

figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width...

NPM: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

NPM: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width vulnerability discovered by ? in WordPress Npm figlet versions 1.11.3...

CVE-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-OZ83684 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the consul package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

SUSE SLES16 Security Update : rpcbind (SUSE-SU-2026:23946-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23946-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for...

openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21975-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21975-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remot...