Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to_atom/1 before any validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERL_MAX_ATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atom_tab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.update_user/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it.
Ash.Actions.Read.AsyncLimiter.await_at_least_one/1 (lib/ash/actions/read/async_limiter.ex) waited for concurrent async read tasks by polling each with Task.yield(task, 0) in a tight loop rather than blocking. While every outstanding task is still running (a slow related-data load or calculation), the loop returns immediately and repeats, busy-spinning and holding a BEAM scheduler at full CPU for the whole duration of the slow read; concurrent slow reads tie up further schedulers. The fix waits with Task.yield_many (a non-blocking sweep followed by a blocking wait with timeout: :infinity), so the process sleeps until a task completes instead of spinning.
This issue affects ash: from 2.19.0 before 3.32.2.
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory.
Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its related rows. flatten_relationships/2 (lib/ash/filter/runtime.ex) eagerly built the full Cartesian product across the filter's to-many relationship paths, so a record with K to-many relationships of M rows each materialized on the order of M^K scenarios before any predicate was checked. A filter or dataset that reaches several sizeable to-many relationships therefore allocates memory combinatorially and can exhaust the node. The fix streams the expansion lazily and short-circuits on the first matching scenario, bounding the work.
This issue affects ash: from 1.29.0-rc0 before 3.32.2.
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected.
Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex) evaluated the :match regex regardless of the min_length and max_length constraints on the same attribute. Because the length check did not gate the regex, an over-length value that the length constraint rejects still had the pattern applied to it, so the length limit that would otherwise bound the work never constrained the regex input. Against a backtracking pattern this yields catastrophic regex evaluation on attacker-sized input, and even a linear pattern runs on arbitrarily large input, consuming CPU per request. The fix skips the :match regex whenever a length constraint is violated, making the two checks order-independent.
This issue affects ash: from 0.10.0 before 3.32.2.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
CVE-2026-55520 is a high-severity vulnerability in the Protego library, a Python robots.txt parser used by the Scrapy project. Versions prior to 0.6.2 are affected by uncontrolled resource consumption due to exponential backtracking in regular expression matching when processing robots.txt directives containing many asterisks. This can cause denial of service by making the can_fetch method spend an attacker-controlled amount of time matching URLs. The issue is fixed in version 0.6.2.
CVE-2026-55247 is a critical vulnerability in plone.app.event, a Plone event content type. Versions prior to 5.2.4 and 6.0.1 allow a logged-in editor to exploit insufficient restrictions on iCalendar import URLs, leading to uncontrolled resource consumption and potential denial of service. The flaw also permits storing malicious event URLs that can execute scripts in other users' browsers. The issue is fixed in versions 5.2.4 and 6.0.1 by restricting URLs, limiting import size and event count, using transaction savepoints, and validating URLs.
A critical vulnerability (CWE-400) in plone.app.portlets prior to versions 5.0.8, 6.0.4, and 7.0.2 allows a member with permission to add an RSS portlet to cause uncontrolled resource consumption by setting an RSS feed URL that returns a very large response. This leads to excessive memory use and denial of service. The vulnerability also permits server-side request forgery (SSRF) by accepting internal hosts, IPs, single-word domains, and explicit ports, enabling probing of internal network services. Additionally, malicious feed items can inject JavaScript URLs that execute scripts when rendered by victims. The issue affects multiple internal validation and caching functions and is fixed in the specified versions.
WatchGuard Dimension version 2.0 is vulnerable to a denial-of-service (DoS) condition triggered by an attacker sending a high volume of TCP SYN packets to its log listening service. This vulnerability is identified as CWE-400, which relates to uncontrolled resource consumption. The CVSS 4.0 base score is 8.7, indicating a high severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild at this time.
CVE-2026-59282 is a high severity vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves uncontrolled resource consumption due to how Spring's data binding applies user-supplied property paths to target objects, potentially causing Denial of Service (DoS). The vulnerability impacts availability but not confidentiality or integrity. No official patch or remediation guidance is currently confirmed. Users should monitor vendor advisories for updates and apply fixes once available.
Trilium versions prior to 0.104.0 have a vulnerability in the automatic image-download feature that allows authenticated users to read arbitrary local files via file:// URLs in note img tags. This occurs because the feature accepts file URLs without path validation, enabling disclosure of files readable by the Trilium process. Additionally, referencing unbounded sources like /dev/zero can cause memory exhaustion and crash the server. The issue affects the web UI, ETAPI, web clipper, and note imports and requires only an authenticated session or ETAPI token. The vulnerability is fixed in version 0.104.0.
CVE-2026-59315 is a medium severity vulnerability in Spring Cloud Config Monitor that allows denial of service via uncontrolled resource consumption triggered by malicious payloads. It affects multiple versions of Spring Cloud Config including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The vulnerability is classified under CWE-400, indicating resource exhaustion issues. No official patch or remediation guidance is currently documented.
A denial of service (DoS) vulnerability exists in Spring Framework versions 5.2.25.RELEASE and earlier through 7.0.8, where user-supplied Spring Expression Language (SpEL) expressions using the power operator (^) with BigDecimal or BigInteger operands and large exponents can cause uncontrolled resource consumption.
CVE-2026-47881 is a medium severity vulnerability in Spring Batch's FlatFileItemReader component. It involves uncontrolled resource consumption when processing specially crafted input files with multi-line logical records. This can cause excessive CPU and memory usage, potentially stalling batch jobs or causing out-of-memory conditions. The issue affects multiple versions of Spring Batch including 4.3.0 through 4.3.13, 5.2.0 through 5.2.6, and 6.0.0 through 6.0.4.
CVE-2026-61617 affects Pterodactyl Wings up to and including version 1.13.2. The vulnerability allows a tenant with SFTP write access to bypass disk quota enforcement during file transfers, potentially exhausting the host node's physical disk space. This occurs because Wings only checks available disk space once when the write handle is opened, using a stale cached value and without accounting for the size of incoming data. As a result, uploads can exceed configured disk limits, causing denial of service by filling the disk. The issue is fixed in version 1.13.3.
Weblate versions prior to 2026.7 contain a vulnerability where users with the "Edit source" role can inject malicious regular expressions without timeout limits. This can cause excessive CPU consumption and lead to denial of service. The issue arises because regex checks are re-run multiple times per request without time limits, allowing catastrophic backtracking patterns to stall the system. This vulnerability is fixed in version 2026.7.
CVE-2026-19401 is a high-severity vulnerability in NLnet Labs NSD version 4.3.7 where a remote attacker can crash a server child process by sending a specially crafted DNS message containing a specific number of DNS Cookie options. This causes a reachable assertion failure in debugging or non-release builds, potentially leading to denial of DNS service if exploited repeatedly.