CVE-2026-53182

wifi: nl80211: reject oversized EMA RNR lists

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the parser aligned with the data structure it fills and matches the existing bound check used by nl80211_parse_mbssid_elems().

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-53132

vsock/virtio: fix potential unbounded skb queue

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0)

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-45860

netfilter: nf_conncount: increase the connection clean up limit to 64

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly. In order to prevent this issue, only skip the GC if it was already triggered during the same jiffy and the increment is lower than the clean up limit. In addition, increase the clean up limit to 64 connections to avoid triggering GC too often and do more effective GCs. This has been tested using a HTTP server and several performance tools while having nft_connlimit/xt_connlimit or OVS limit configured. Output of slowhttptest + OVS limit at 52000 connections: slow HTTP test status on 340th second: initializing: 0 pending: 432 connected: 51998 error: 0 closed: 0 service available: YES

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-43493

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-43329

netfilter: flowtable: strictly check for maximum number of actions

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SNAT (4 payload actions) * DNAT (4 payload actions) * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ. * Redirect (1 action) Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions. Update flow_action_entry_next() calls to check for the maximum number of supported actions. While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-112269

SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sgl-project

Products

Sglang

CVE-2026-112270

SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Sgl-project

Products

Sglang

CVE-2026-100795

Denial-of-service in the Networking component

Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-62706

Authlib : JWE zip=DEF decompression bomb enables DoS

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Authlib

Products

Authlib

CVE-2026-110257

OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ow2

Products

Asm

CVE-2026-110258

OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ow2

Products

Asm

CVE-2026-18618

Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Ai

CVE-2026-67447

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axllent

Products

Mailpit

CVE-2026-67446

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axllent

Products

Mailpit

CVE-2026-109227

SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Lmsys Sgl-project

Products

Sglang Sglang

CVE-2026-108859

mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mark3labs

Products

Mcp-go

CVE-2026-111383

Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nezhahq

Products

Nezha

CVE-2026-79607

Xenstore: Guests can crash xenstored during Live Update

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2026-102048

Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled

An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled. This issue affects all platforms except the PTX Series and SRX Series.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os

CVE-2026-105759

vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm