CVE-2026-68497 is a high-severity denial of service vulnerability in FasterXML jackson-databind affecting versions >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2. It arises because the library deserializes JSON strings bound to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing them directly to JDK factory methods that parse numeric components with O(n²) complexity, without enforcing length limits on the string input. This allows an unauthenticated attacker to cause excessive CPU consumption and denial of service by submitting a specially crafted JSON string with very long numeric components. No polymorphic typing or special configuration is required to trigger this issue.
CVE-2026-45769 is a high-severity vulnerability in the Suricata network security engine affecting versions prior to 7.0.16 and between 8.0.0 and before 8.0.5. The issue involves uncontrolled resource consumption due to the IKEv2 parser state growing without bounds when storing client transforms. This can lead to excessive memory use and potential denial of service. The vulnerability is fixed in Suricata versions 7.0.16 and 8.0.5. Mitigations include disabling IKE application-layer parsing if not needed or using a rule to bypass IKE flows after a certain number of packets.
CVE-2026-45768 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Versions from 8.0.0 up to but not including 8.0.5 are affected. The issue involves uncontrolled resource consumption due to LDAP transaction state storing an unbounded number of responses, which can lead to excessive memory use and potential denial of service. The vulnerability arises because LDAP can be processed over UDP, allowing crafted traffic to trigger this condition. Version 8.0.5 includes a fix for this problem. As a mitigation, disabling LDAP application-layer parsing when not needed or using a detection rule to alert on excessive LDAP responses is recommended.
CVE-2026-45766 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Versions prior to 7.0.16 and 8.0.5 have insufficient bounds on certain NFS parser state structures. This flaw allows crafted NFS traffic to cause excessive memory consumption, potentially leading to denial of service. Fixed in versions 7.0.16 and 8.0.5. Disabling NFS application-layer parsing is a recommended workaround if that functionality is not required.
CVE-2026-45765 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Prior to versions 7.0.16 and 8.0.5, Suricata's DNP3 protocol reassembly could consume excessive memory due to insufficient parser-level bounds, potentially leading to denial of service. The issue is fixed in versions 7.0.16 and 8.0.5. As a mitigation, users can disable DNP3 if not needed or limit the stream reassembly depth.
CVE-2026-45759 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Prior to versions 7.0.16 and 8.0.5, Suricata could be forced to repeatedly parse large HTTP Content-Disposition headers during HTTP response processing, leading to excessive CPU usage and denial of service. This uncontrolled resource consumption issue is fixed in versions 7.0.16 and 8.0.5. A workaround involves using a specific Suricata rule to detect and bypass large Content-Disposition headers.
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.
Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-83968 is a use-after-free vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has issued official fixes for all affected versions.
CVE-2026-72923 is an uncontrolled resource consumption vulnerability in Microsoft OpenAPI.NET's YAML parsing components. It arises from nested anchors and aliases in YAML OpenAPI documents, which can cause exponential memory allocation during conversion to JSON nodes. This can lead to process termination due to out-of-memory conditions. The vulnerability affects Microsoft.OpenApi.YamlReader versions >=2.0.0-preview.11 and <2.12.0, >=3.0.0 and <3.10.0, and Microsoft.OpenApi.Readers versions <1.6.30. Patched versions are available that impose limits on node count and nesting depth to prevent unbounded expansion. The impact is limited to availability and denial of service; no code execution or data exposure is reported.
A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.
CVE-2026-12611 is a high-severity vulnerability in Eclipse Jetty where a race condition in HTTP/2 frame handling can cause server threads to become indefinitely blocked, leading to server unresponsiveness. The issue arises when the server processes RST_STREAM and GOAWAY frames, causing the HTTP2Flusher.terminated flag to be reset improperly. This allows entries to be enqueued that are never processed, blocking threads waiting on writes.
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.