CWE-770: Unthrottled Resource Allocation vulnerabilities

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

CVE-2026-105758 is a resource allocation vulnerability in vllm versions 0.24.0 through 0.29.999 that allows unauthenticated attackers to submit excessive video frame and frame rate values to the /tokenize endpoint. This can cause disproportionate memory consumption and potentially terminate the API process. The issue is fixed in version 0.30.0.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.

CVE-2026-94201 is a high-severity vulnerability in the ash-project's ash library affecting versions from 3.5.1 up to but not including 3.34.3. It arises from unsafe handling of :atom-typed attributes with the unsafe_to_atom? constraint set to true, leading to unbounded atom table growth when attacker-controlled filter values are used. This can exhaust the BEAM atom table and crash the node, causing a denial of service. The issue is fixed by adding a coercion method that avoids interning new atoms during filtering comparisons.

CVE-2026-104713 is a resource allocation vulnerability in the Apache Struts REST plugin. The plugin reads request bodies into memory without limiting their size, allowing a single request to consume excessive Java heap memory. This can lead to denial of service by exhausting server resources. The vulnerability affects multiple Apache Struts versions, and fixed versions are available.

Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where authenticated users can modify API token rate limits without server-side validation. This allows users to arbitrarily increase their allowed_rate_limit, bypassing intended API rate-limiting controls and potentially causing resource exhaustion. The issue is fixed in version 1.4.0.

CVE-2026-97873 is a vulnerability in Bouncy Castle for Java before versions 1.86 and 2.73.13. It involves the legacy PBES1 and PKCS#12 password-based encryption (PBE) schemes running key derivation with an iteration count taken from untrusted input without proper limits. This allows an attacker to specify an arbitrary amount of computational work, potentially causing resource exhaustion. The issue is addressed by bounding the iteration count with a configurable maximum and rejecting out-of-range values.

CVE-2026-104845 is a high-severity vulnerability in the seroval library prior to version 1.6.3. It involves unbounded allocation of resources during deserialization of TypedArrays from untrusted JSON input, which can lead to CPU or memory exhaustion and event loop starvation. The flaw does not impact confidentiality or integrity. The issue is fixed in seroval version 1.6.3.

CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-66054 is a medium severity vulnerability in Apache Thrift C++ bindings that involves allocation of resources without limits or throttling. This flaw leads to improper handling of highly compressed data, resulting in potential data amplification issues. The vulnerability affects Apache Thrift versions prior to 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-61374 is a high-severity vulnerability in Apache Thrift's Java bindings that involves allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0 and can lead to resource exhaustion. The Apache Software Foundation has addressed this issue in version 0.25.0. Users should upgrade to this fixed version to mitigate the risk.

CVE-2026-63772 is a high-severity vulnerability in Apache Thrift's Go bindings involving allocation of resources without limits or throttling. This flaw affects all versions before 0.25.0. The issue can lead to resource exhaustion due to uncontrolled allocation. The Apache Software Foundation has fixed the vulnerability in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.

CVE-2026-66331 is a resource allocation vulnerability in Apache Thrift affecting versions before 0.25.0. It involves the Delphi bindings buffered transport component, where resources can be allocated without proper limits or throttling. This can potentially lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.

CVE-2026-83632 is a critical vulnerability in Apache Thrift before version 0.25.0 involving allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. This flaw can lead to severe impacts including potential denial of service or arbitrary code execution. The issue is fixed in Apache Thrift version 0.25.0. Users should upgrade to this version to mitigate the risk.

CVE-2026-61373 is a medium-severity vulnerability in Apache Thrift's Java TSaslNonblockingServer prior to version 0.25.0. It allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The issue is fixed in version 0.25.0. Users should upgrade to this version to mitigate the risk.

CVE-2026-94648 is a medium-severity vulnerability in Apache Thrift's Dart bindings that allows allocation of resources without limits or throttling. This flaw affects all versions prior to 0.25.0. The vulnerability has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-94638 is a medium severity vulnerability in Apache Thrift PHP bindings prior to version 0.25.0. It involves allocation of resources without limits or throttling, which can lead to resource exhaustion. The vulnerability is fixed in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.