Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,412

Export CSV
CVE-2026-118487

Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation
Products
Vert.x Vert.x
CVE-2026-115825

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Perl
Products
Http::server::psgi
CVE-2026-119051

flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Flat Project
Products
Flat
CVE-2026-119371

SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite
CVE-2025-12767

Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Concert Linux Kernel
CVE-2026-118689

OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ovenmedialabs
Products
Ovenmediaengine
CVE-2026-108048

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-116775

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Eugeny
Products
Russh
CVE-2026-115721

Apache Vysper: Unbounded allocation

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Vysper
CVE-2023-45862

kernel: drivers/usb/storage/ene_ub6250.c

An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Unified Manager H410c and 3 more
CVE-2026-54462

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Knative
Products
Pkg
CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Libressl
CVE-2026-116696

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Eugeny
Products
Russh
CVE-2026-116877

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Semantic-mediawiki
Products
Semantic Mediawiki
CVE-2026-116584

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Lxsmnsyc
Products
Seroval
CVE-2025-4416

Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Events Log Track Project
Products
Events Log Track
CVE-2026-115913

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-11622

Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Isc
Products
Bind
CVE-2026-115824

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending. A remote attacker can exhaust worker memory with a single connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miyagawa
Products
Starman