Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,412

Export CSV
CVE-2026-104817

Misskey: Lack of rate limiting and size restrictions in RSS fetching API

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Misskey
Products
Misskey
CVE-2026-89295

Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Mnestix
CVE-2026-125205

FFmpeg through 9.0.2 Memory Exhaustion via av1_frame_merge Bitstream Filter

FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-123997

Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted SetAVTransportURI request on TCP port 38400. Attackers can exploit this flaw without credentials to render the device completely unresponsive to remote control or front-panel input, requiring a physical power cycle to restore functionality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hisense
Products
Vidaa
CVE-2026-125180

FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags

FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125186

FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123817

AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantially exceeds the payload bytes allowed by max_msg_size. The condition affects a server receiving frames from a malicious client and a client receiving frames from a malicious server, and can cause excessive memory consumption or denial of service. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp
CVE-2026-110944

Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt Qthttpserver
CVE-2026-115339

Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server

Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-77622

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Bishopfox
Products
Sliver
CVE-2026-49407

OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local  /ws/dictation  WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tinyhumansai
Products
Openhuman
CVE-2026-111768

Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123096

anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response

anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed announce or scrape responses that Client.Announce and Client.Scrape buffer without limits, exhausting process memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Anacrolix Torrentflux Project
Products
Torrent Torrentflux
CVE-2026-123575

Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123576

Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests

Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123610

rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rustls Rustls Project
Products
Rustls Rustls
CVE-2026-120367

Apache Axis2/Java: unbounded JSON request body buffering

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Axis2/java