Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,922

Export CSV
CVE-2026-110677

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rurban
Products
Cpanel::json::xs
CVE-2026-119195

pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pyasn1
Products
Pyasn1
CVE-2026-67312

axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Axios
Products
Axios
CVE-2026-116177

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-116141

ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-115775

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Twisted
Products
Twisted
CVE-2026-118694

python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Python-markdown2 Project
Products
Python-markdown2
CVE-2026-118664

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Samverschueren
Products
Decode-uri-component
CVE-2026-118589

nschloe meshio VTK Reader _vtk_42.py memory allocation

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nschloe
Products
Meshio
CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rurban
Products
Cpanel::json::xs
CVE-2026-116095

smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Smg-project
Products
Smg
CVE-2026-115638

openstack-ironic: openstack-ironic: Denial of Service via decompression bomb in configdrive

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Ironic
CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Rurban
Products
Cpanel::json::xs
CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Rurban
Products
Cpanel::json::xs
CVE-2026-67414

RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Rabbitmq
Products
Rabbitmq-server
CVE-2026-115774

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Twisted
Products
Twisted
CVE-2026-115572

pypdf: Possible long runtimes for repeated references to the same missing object

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Py-pdf
Products
Pypdf
CVE-2026-91400

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Graalvm Graalvm Enterprise Edition Graalvm For Jdk and 2 more
CVE-2026-75508

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Graphql-python
Products
Graphql-core