A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.
The vulnerability is accessible when the Redis service is enabled only.
The Canary is NOT affected if the Redis service is disabled.
Thinkst has addressed this issue on all supported platforms.
New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries.
Workarounds are available for customers unable to update at this time.
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable. The fix validates peer-supplied label maps before they are retained or disseminated. Availability only; no confidentiality or integrity impact was identified.
Autobahn Python before version 26.7.1 has a vulnerability in its WebSocket implementation where compressed messages can bypass the configured maximum message payload size after decompression. This allows a remote unauthenticated attacker to send a compressed frame within the allowed size that decompresses to a much larger message, causing resource exhaustion. The issue does not impact confidentiality or integrity. The vulnerability is fixed in version 26.7.1.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
AnyIO versions prior to 4.14.2 contain a resource allocation vulnerability where process-pool workers' standard error pipes are not drained by the parent process. This can cause the pipe to fill and block the worker if it writes enough data to stderr, leading to indefinite blocking of the process-pool call. The issue affects applications running untrusted or faulty worker code that produces substantial standard error output. The vulnerability is fixed in AnyIO version 4.14.2.
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
CVE-2026-84447 is a high-severity vulnerability in libheif versions 1.23.1 and earlier. It involves allocation of resources without limits or throttling due to crafted reference graphs that cause repeated decoding of the same base image. This leads to excessive resource consumption and potential denial of service. The issue is fixed in version 1.23.2.
CVE-2026-10832 is a resource exhaustion vulnerability in the DERDecoder class of wildfly-elytron-asn1 used by Red Hat JBoss Enterprise Application Platform 8.1.8.GA. A remote attacker can send a crafted DER payload with an inflated length value causing excessive memory allocation and JVM memory exhaustion. This leads to a remote denial of service (DoS) affecting services that process untrusted DER/ASN.1 input, including SASL authentication and X.500 certificate principal parsing. No mitigation or patch currently meets Red Hat's criteria for ease of use and applicability.
CVE-2026-93491 is a denial of service vulnerability in the Netty HttpServerCodec component used by Red Hat Build of Apache Camel 3.33.3.SP2. An unauthenticated remote attacker can exploit this by sending pipelined HTTP/1.1 requests on a single connection and withholding reads, causing unbounded queue growth and excessive heap memory consumption, leading to service disruption. Multiple specific versions are affected. No official fix or mitigation meeting Red Hat's criteria is currently available.
CVE-2026-93488 is a denial of service vulnerability in Netty's SpdySessionHandler component used by Red Hat Build of Apache Camel 3.33.3.SP2. The flaw arises because the default localConcurrentStreams setting is set to Integer.MAX_VALUE with no API to modify it, allowing a remote attacker to open an unlimited number of concurrent SPDY streams. This can cause unbounded memory allocation, leading to JVM OutOfMemoryError and service disruption. No official patch or mitigation meeting Red Hat's criteria is currently available.
A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through a bug report but has not responded yet.
CVE-2026-77281 is a medium severity vulnerability in caddyserver caddy versions prior to 2.11.4. It involves improper control of code generation (code injection) in the rewrite handler and placeholder layer. Specifically, when a rewrite URI ends with a literal question mark, attacker-controlled replacement bytes can be passed through a second placeholder expansion, potentially disclosing environment or request-variable data and readable files if the file provider module is registered. This issue is fixed in version 2.11.4.
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very large value, causing per-request hash-map allocation and unbounded CPU and memory consumption. Baggage extraction is enabled by default in most affected tracers unless baggage is removed from DD_TRACE_PROPAGATION_STYLE or DD_TRACE_PROPAGATION_STYLE_EXTRACT, so affected internet-facing services can be denied service. This issue is fixed in version 2.1.0.
CVE-2026-50275 is a high-severity vulnerability in DataDog's dd-trace-php library prior to version 1.19.2. It involves the ddtrace_deserialize_baggage function parsing incoming W3C baggage HTTP headers without enforcing limits on the number or size of key-value pairs. This allows a remote unauthenticated attacker to cause unbounded CPU and memory consumption by sending large or numerous baggage items. The issue is fixed in version 1.19.2.
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and processRpcSubOpt in packages/floodsub/src/floodsub.ts synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.
CVE-2026-25281 is a high-severity vulnerability in Qualcomm Snapdragon devices WSA8840 and WSA8845. It involves allocation of resources without limits or throttling, leading to a transient denial of service (DoS) when processing large or numerous request buffers without sufficient memory allocation validation.
CVE-2026-75516 is a high-severity vulnerability in the rabbitmq-java-client library prior to version 5.34.0. It involves improper handling of frame size limits during AMQP connection negotiation, allowing a malicious server or man-in-the-middle attacker to cause excessive memory allocation. This can lead to client process termination due to memory exhaustion. The issue is fixed in version 5.34.0.
CVE-2026-81176 is a denial of service vulnerability in the sveltejs devalue JavaScript library prior to version 5.9.2. The issue arises because devalue.parse does not reject out-of-bounds indices, leading to excessive computational work when parsing specially crafted untrusted payloads. This can cause applications using vulnerable versions to experience performance degradation or denial of service. The vulnerability is fixed in version 5.9.2.
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when startup configuration selected a software decoder. The engine's _reserve_mm_ipc_gpu_memory logic budgets decoder memory only from static configuration, so the request-selected VIDEO_LOADER_REGISTRY backend can create a CUDA context, decoder surfaces, and decoded-frame allocations that were not removed from the engine's KV-cache budget. An attacker able to submit video requests to a video-capable GPU deployment with PyNvVideoCodec installed can exhaust shared GPU memory, causing request failures, worker crashes, or denial of service. The first release containing the fix is version 0.28.0.