The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and processRpcSubOpt in packages/floodsub/src/floodsub.ts synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.
CVE-2026-81872 is a medium severity availability vulnerability in the open-telemetry opentelemetry-go SDK. The BatchingProcessor in sdk/log can enter a tight CPU loop when the asynchronous export buffer is full and the exporter is backpressured. This causes repeated immediate export retries, leading to CPU exhaustion and denial of service in the affected application. The issue affects versions prior to 0.21.0. No official patch or fix status is provided in the input data.
CVE-2026-81869 is a medium severity vulnerability in the OpenTelemetry Go SDK trace package that allows bypass of the configured attribute value length limit for string attributes containing the Unicode replacement character U+FFFD. This flaw causes oversized attacker-controlled attribute values to be stored untruncated, weakening memory and denial-of-service protections. The vulnerability requires deployments with attribute value length limits enabled and attacker-controlled data recorded into span attributes. There is no indication of confidentiality or integrity impact.
CVE-2026-76646 is a high-severity vulnerability in Apache MyFaces that allows a remote attacker to cause uncontrolled resource consumption by sending specially crafted request parameters. This can lead to a denial of service (DoS) condition. The issue affects multiple versions of Apache MyFaces, and fixed versions have been released. Users are advised to upgrade to the specified fixed versions to mitigate the risk.
HAPI FHIR versions prior to 6.9.12 contain an improper input validation vulnerability in the SHCParser component. This flaw can cause an infinite loop when processing specially crafted Smart Health Card JWTs with a 'zip' header set to 'DEF' and an empty or truncated raw-DEFLATE payload. The infinite loop can indefinitely pin a JVM worker thread, potentially exhausting all validation workers under concurrent requests. This issue is fixed in version 6.9.12.
CVE-2026-81875 is a high-severity vulnerability in HAPI FHIR's org.hl7.fhir.core component prior to version 6.9.12. The SHCParser improperly validates input when decompressing Smart Health Card JWT content with a 'zip' header set to 'DEF'. This leads to unbounded memory allocation during decompression, potentially causing excessive heap usage, severe garbage collection pressure, request failures, or process crashes. The issue is fixed in version 6.9.12.
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only from static configuration, so the request-selected VIDEO_LOADER_REGISTRY backend can create a CUDA context, decoder surfaces, and decoded-frame allocations that were not removed from the engine's KV-cache budget. An attacker able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes, or denial of service. The first release containing the fix is version 0.28.0.
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.
CVE-2026-73175 is a high-severity vulnerability in the OPC UA gateway component of the Advantech EKI-1242IEIMS device firmware version 1.06.01 and earlier. It allows an adjacent unauthenticated attacker to exhaust the server session pool by opening multiple anonymous sessions, resulting in a denial of service for legitimate OPC UA clients.
CVE-2026-87828 is a vulnerability in the Seraphinite Accelerator WordPress plugin before version 2.29.24. It allows authenticated users with low privileges, such as subscribers, to trigger a denial of service by submitting a malformed value via an AJAX action that lacks proper capability checks. This causes an uncaught error on every subsequent admin page load, rendering the entire admin area inaccessible to administrators.
CVE-2026-61554 is a high-severity vulnerability in the emp3r0r C2 software prior to version 4.2.5. The issue involves uncontrolled resource consumption due to the http_poll C2 transport accepting attacker-controlled HTTP polling sessions before authentication is completed. This allows a remote unauthenticated attacker to create arbitrary polling sessions and send request bodies that are processed by the C2 server, potentially exhausting server resources. The vulnerability is patched in version 4.2.5.
A vulnerability in Oracle VM VirtualBox version 7.2.16 and multiple other specific versions allows an unauthenticated attacker with network access via RDP to cause a denial of service by hanging or crashing the application. The vulnerability impacts availability but does not affect confidentiality or integrity. It is identified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS 3.1 base score of 7.5, indicating medium severity. Oracle recommends applying security patches promptly but no explicit patch information is provided in the advisory.
CVE-2026-76821 is a high-severity vulnerability in OpenCTI-Platform's opencti prior to version 7.260706.0. It involves uncontrolled resource consumption due to the JSON ingestion mapper's extractWithRegexp function compiling user-supplied regular expressions without complexity validation. An authenticated user with JSON mapper creation permission can supply a malicious regex causing catastrophic backtracking, blocking the Node.js event loop and making the GraphQL API unavailable. The issue affects availability but does not expose or modify data. The vulnerability is fixed in version 7.260706.0.
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can therefore bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use. The resulting string is also processed by NodeHtmlMarkdown.translate(), increasing CPU consumption and allowing an unauthenticated HTTP client to cause denial of service. This issue is fixed in version 1.7.1.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.
AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.