Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,412

Export CSV
CVE-2026-102713

Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-117346

Denial of Service via Unlimited Undo Files in Bitcoin Core

Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bitcoin
Products
Bitcoin Core
CVE-2026-119376

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite
CVE-2026-119204

pypdf: Possible large memory usage when parsing page tree

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Py-pdf
Products
Pypdf
CVE-2026-119196

pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pyasn1
Products
Pyasn1
CVE-2026-119191

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-119187

Forge: Denial of service in TLS record processing via call stack exhaustion

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-119119

Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Unclecode
Products
Crawl4ai
CVE-2026-118590

nipy nibabel Header volumeutils.py array_from_file memory allocation

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nipy
Products
Nibabel
CVE-2026-121388

FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-108837

Apache Kylin: Potential computed-column resource exhaustion

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-96377

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Combined Image Style
CVE-2026-63501

ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Agamnentzar
Products
Ag-psd
CVE-2026-118488

Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for EOL-terminated lines. If a malicious server sends a specially crafted RESP response (for example a bulk string [2] with missing CRLF trailer), the parser enters an infinite loop where it keeps parsing the same buffer and pushing the same response to the caller, which may lead e.g. to an OOM if the consumer just buffers the responses. We must fix the parser to avoid this infinite looping.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation
Products
Vert.x Vert.x
CVE-2026-121412

FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-108147

Potential memory exhaustion in MultiPartParser via base64-encoded file upload

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Django Project Djangoproject
Products
Django Django
CVE-2026-115715

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-115716

Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Apm Server
CVE-2026-121405

FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-119194

pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pyasn1
Products
Pyasn1