The vulnerability of the h2 library in the Rust programming language, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the h2 library in the Rust programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-31899

CVE-2026-31899: Экспоненциальный DoS через рекурсивную амплификацию элементов в CairoSVG Ключевые слова: CVE-2026-31899, CairoSVG, экспоненциальный DoS, SVG-бомба, рекурсивный элемент use, отказ в обслуживании, XML-амплификация, уязвимость Python SVG, CWE-400, неконтролируемое потребление ресурсо...

POC_CVE-2024-12537

CVE-2024-12537 ओपन वेबयूआई कोड फॉर्मेट DoS लैब यह रिपॉजिटरी CVE-2024-12537 के लिए एक स्थानीय, पृथक पुनरुत्पादन लैब और न्यूक्ली टेम्पलेट उम्मीदवार रखती है, जो ओपन वेबयूआई के कोड फॉर्मेटिंग एंडपॉइंट में एक अप्रमाणित डिनायल-ऑफ-सर्विस कमजोरी है। लैब बड़े डिनायल-ऑफ-सर्विस पेलोड नहीं भेजता। यह ओपन...

GHSA-FF5C-CP5C-9WJF NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

CVE-2026-36958

CVE-2026-36958: رفض الخدمة عبر طلبات HTTP المتزامنة معرف CVE: CVE-2026-36958 التاريخ: 2026-04-29 المكتشف: Kirubel Solomne البائع: U-SPEED المنتج: راوتر U-SPEED إصدار البرنامج الثابت: V1.0.0 CWE: CWE-400 - استهلاك غير متحكم فيه للموارد الوصف البرنامج الثابت V1.0.0 لراوتر U-SPEED عرضة لرفض الخدمة. ...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Regular Expression Denial of Service.

Summary brace-expansion is used by IBM Storage Fusion Data Foundation, which could cause Regular Expression Denial of Service. CVE-2026-13149, CVE-2026-33750. Vulnerability Details CVEID:CVE-2026-33750 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix...

CVE-2026-82742

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82743

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

EUVD-2026-68948

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82742

CVE-2026-82742 is an uncontrolled resource consumption vulnerability in the ash Elixir framework (versions 1.29.0-rc0 through before 3.32.2 ). The root cause is in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex), which eagerly materializes the full Cartesian prod...

EUVD-2026-68947

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

EUVD-2026-68962

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

EEF-CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.apply\constraints/2 lib/ash/type/string.ex evaluated the :match regex...

CVE-2026-75140

A flaw was found in jsoup. A remote attacker could exploit an uncontrolled resource consumption vulnerability in the XmlTreeBuilder by providing a deeply nested XML document with uniquely-namespaced elements. This causes the builder to copy the entire inherited namespace map on every start elemen...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257 and CVE-2026-69152. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...