Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,924

Export CSV
CVE-2026-47566

nvidia-driver: nvidia-driver: Denial of Service via kernel memory leak

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Guest Driver Nvs and 3 more
CVE-2026-47567

nvidia-driver: nvidia-driver: Denial of Service via DRM VMA address space exhaustion

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Guest Driver Nvs and 4 more
CVE-2026-47568

nvidia-driver: nvidia-driver: Denial of Service via uncontrolled kernel logging

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Guest Driver Nvs and 4 more
CVE-2026-19587

rlottie: rlottie: Denial of Service due to excessive resource allocation

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Open Source
Products
Rlottie Rlottie
CVE-2026-68911

Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nicotine-plus
Products
Nicotine+
CVE-2026-102821

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Eugeny
Products
Russh
CVE-2026-61816

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Zbateson
Products
Mail-mime-parser
CVE-2026-102414

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Browserify
Products
Pbkdf2
CVE-2026-100662

Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100650

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route — the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or, on some paths, never applies it). A remote attacker can therefore cause the API server or batch-runner process to allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media item count before the request is rejected, resulting in pre-inference memory and bandwidth exhaustion (denial of service). The chat and batch surfaces require an API key when one is configured; the Rust frontend /tokenize route is unauthenticated by design. There is no code execution or data disclosure impact.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vllm
Products
Vllm
CVE-2026-102006

VxWorks 7 Memory allocation

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Windriver
Products
Vxworks
CVE-2026-94397

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-94398

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-56725

Zammad: Denial of Service via OTRS Import Controller

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zammad
Products
Zammad
CVE-2026-102277

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Juliangruber
Products
Brace-expansion
CVE-2026-94399

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-94400

Uncontrolled Resource Consumption in Kibana Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2026-94396

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-82294

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch