CVE-2024-39478

crypto: starfive - Do not free stack buffer

In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-30073

Free5GC NssaiAvailabilitySubscriptionCreate Component Denial of Service via Crafted POST

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Free5gc

Products

Free5gc

CVE-2026-71257

Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket falls back to reading the upload through HttpServletRequest#getParts(). The per-file size limit (for example Form#setFileMaxSize) and the file count limit (Form#setFileCountMax) are not applied to the parts obtained that way, and no exception is raised, so the upload is processed as though those limits had been satisfied. A remote uploader can therefore submit files that are larger, or more numerous, than the application permits, up to whatever the component that parsed the request allows. A part carrying no Content-Type header is additionally read into memory in full during parsing, so the size of that allocation is determined by the request and bounded only by those same external limits. The total upload size limit (Form#setMaxSize) is not affected. Commons FileUpload compares the declared Content-Length against it before reading the body, so a request declaring an oversized length is rejected before the fallback is reached. The fallback is reached in deployments where a servlet or filter has already parsed the request body — for example a servlet annotated with @MultipartConfig, Spring Boot's multipart resolver, or any filter that calls HttpServletRequest#getParameter() on a multipart request. It applies to the Wicket components that accept uploads on that path, including Form with FileUploadField, FileUploadToResourceField and AjaxFileDropBehavior. Applications that configure neither a per-file nor a file-count limit are not affected, as Wicket applies neither by default. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. As a workaround, configure equivalent limits in the component that parses the request — for example spring.servlet.multipart.max-file-size and max-request-size, or maxFileSize and maxRequestSize in @MultipartConfig or in the web.xml <multipart-config> element.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wicket

CVE-2026-47863

Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Reactor Core Reactor Core

CVE-2023-39533

libp2p nodes vulnerable to attack using large RSA keys

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Libp2p

Products

Go-libp2p

CVE-2026-59848

Libssh: libssh: denial of service via sftp responses with unknown request ids

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Hardened Images and 1 more

CVE-2026-74837

Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.convert_to_field_atom/2 in lib/ash_typescript/field_formatter.ex converts a client-supplied field name to an atom with String.to_atom/1 when no matching atom already exists. It delegates first to parse_input_field/2, which resolves the name with String.to_existing_atom/1 and falls back to returning the plain string; convert_to_field_atom/2 then mints an atom from that string rather than treating the name as unknown. RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError. This issue affects ash_typescript: from 0.1.0 before 0.18.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ash-project

Products

Ash Typescript

CVE-2026-19472

Rockwell Automation ArmorStart® LT Denial Of Service

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation Rockwellautomation

Products

Armorstart Lt Armorstart Lt

CVE-2026-64773

Unbounded Memory Buffer via Container TCP Forwarding

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Container

CVE-2026-47628

Unbounded Resource Allocation Exploit in NVIDIA Triton Inference Server

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Triton Inference Server

CVE-2026-67317

axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axios

Products

Axios

CVE-2026-72678

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-77856

Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit. This issue affects ash_typescript: from 0.11.0 before 0.18.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ash-project

Products

Ash Typescript

CVE-2026-72684

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2026-79771

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-71054

Oracle Java SE 2D Component Denial of Service via Untrusted Data

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Oracle Java Se

CVE-2026-27852

dovecot: Dovecot: Denial of service via crafted email headers

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Open-xchange

Products

Ox Dovecot Ce Ox Dovecot Pro

CVE-2026-40017

dovecot: Dovecot: Denial of Service via crafted IMAP message headers

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Open-xchange

Products

Ox Dovecot Ce Ox Dovecot Pro

CVE-2026-42391

dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Open-xchange

Products

Ox Dovecot Ce Ox Dovecot Pro

CVE-2026-52681

dovecot: Dovecot: Denial of Service via Sieve script manipulation

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Open-xchange

Products

Ox Dovecot Ce Ox Dovecot Pro