CVE-2026-78669

Excessive CPU consumption from repeated initial window changes in net/http

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Net/http Net/http2

CVE-2026-83457

HTTP Access Control Flaw Enables Data Modification and DoS in Oracle Demand Signal Repository

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Signal Repository accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Demand Signal Repository E-business Suite

CVE-2026-97031

Reject malformed ECH outer extension references in crypto/tls

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Crypto Tls

CVE-2026-105826

ImageMagick: ImageMagick: Denial of Service via MAT decoder policy bypass

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-105825

ImageMagick: ImageMagick: Denial of Service via crafted XMP profile

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-105399

ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-105922

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-61801

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Moby Redhat

Products

Sys Hummingbird

CVE-2026-107297

msgpack5: Quadratic parsing in the streaming decoder

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mcollina

Products

Msgpack5

CVE-2026-106550

CVE-2026-106550

Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Convict

CVE-2026-97714

Denial of service vulnerability in Secure Access

CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97715

Denial of Service in Absolute Secure Access

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97716

Denial of Service in Absolute Secure Access

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-97717

Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-107227

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Asynchttpclient Project

Products

Async-http-client

CVE-2026-107574

Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progressive Robot

Products

Hmailserver

CVE-2023-22490

Git vulnerable to local clone-based data exfiltration with non-local transports

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Git-scm Redhat

Products

Git Enterprise Linux Rhel Eus

CVE-2022-32189

Panic when decoding Float and Rat types in math/big

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Golang Redhat

Products

Go Ceph Storage Container Native Virtualization and 10 more

CVE-2022-29885

EncryptInterceptor does not provide complete protection on insecure networks

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

CVSS 3.1 · 7.5 High EPSS 73.5% KEV · Not listed

Vendors

Apache Debian Oracle

Products

Tomcat Debian Linux Hospitality Cruise Shipboard Property Management System

CVE-2022-26878

kernel: Memory leak in Linux VirtIO Bluetooth driver

drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel