An uncontrolled resource consumption vulnerability exists in Apache Tomcat due to an allocation leak in HTTP/2 backlog tracking when a stream is reset. This affects multiple versions across the 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. The vulnerability can lead to denial of service by exhausting server resources. Fixed versions have been released to address this issue.
Mesop versions prior to 1.3.3 have an uncontrolled resource consumption vulnerability in debug mode via the /hot-reload endpoint. An unauthenticated attacker can supply a high counter parameter value to cause worker thread exhaustion, leading to server unavailability until manual restart. This denial-of-service condition is fixed in version 1.3.3.
CVE-2026-53965 is a medium severity vulnerability in the Model Context Protocol PHP SDK (mcp/sdk) versions 0.5.0 through 0.7.0. The HTTP client transport reads Server-Sent Events (SSE) streams into an unbounded in-memory buffer, which only flushes upon receiving a double newline delimiter. A malicious or compromised server that never sends this delimiter can cause the buffer to grow indefinitely, exhausting client memory and causing a denial of service. This affects any client using HttpTransport against an untrusted server and requires no authentication or user interaction beyond connection initiation. The issue is fixed in version 0.7.1.
ORAS CLI versions up to and including 1.3.2 have a vulnerability where recursive referrer traversal does not track visited descriptors, allowing a malicious OCI registry to cause unbounded recursion and memory growth. This leads to client-side denial of service by exhausting CPU and memory resources, affecting commands like oras discover, backup, and restore. The issue is fixed in version 1.3.3.
A denial of service vulnerability exists in the collective icalendar Python library versions from 7.1.0 up to but not including 7.1.3. The vulnerability arises from an exponential time complexity in the Component equality method when comparing deeply nested subcomponents, which can be exploited by submitting crafted .ics files with nested BEGIN:VEVENT blocks. This causes excessive CPU consumption during certain comparison operations, potentially pinning a CPU core for minutes or indefinitely. The issue is fixed in version 7.1.3.
CVE-2026-71360 is an Uncontrolled Resource Consumption vulnerability in Adobe's C2PA Tool that can lead to application denial-of-service. The flaw allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. No patch or official remediation has been indicated yet.
CVE-2026-15310 is a low-severity vulnerability in CPython where decompressing specially crafted zip files using bzip, LZMA, or Zstandard compression methods can lead to memory exhaustion. This occurs because Python may use an attacker-controlled size to pre-allocate memory during decompression. The vulnerability affects multiple CPython versions prior to specific patch releases. No known exploits are reported in the wild, and no patch information is provided in the input data.
CVE-2026-55531 is an uncontrolled resource consumption vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the MCP HTTP Stream mcp_post handler creates a new session entry for every initialize request without cleaning up old sessions or enforcing a maximum limit. This allows an unauthenticated attacker to exhaust memory resources. The issue is fixed in version 4.6.58 by invoking session cleanup and limiting the number of sessions via PRAISONAI_MCP_MAX_SESSIONS.
CVE-2026-12600 is a high-severity denial-of-service vulnerability in the Poppler fork developed by Innodata Labs. It arises from uncontrolled memory allocation during JPEG2000 (JPX) image decoding in the JPXStream::readCodestream() function. An attacker can craft a malicious PDF with JPXDecode images that cause excessive memory consumption, leading to process termination due to out-of-memory conditions.
OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an integer overflow vulnerability in the SampleCountChannel component. This flaw causes an infinite loop when the sample-list size is rounded up to the next power of two, due to a 32-bit unsigned integer wraparound. The issue can be triggered via public APIs by setting a pixel sample count to UINT_MAX. This vulnerability has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
CVE-2026-77384 is a high-severity vulnerability in the JavaScript implementation of libp2p (js-libp2p) prior to version 4.2.9. It involves uncontrolled resource consumption due to repeated registration of abort listeners on every reservation refresh in the reservation-store.ts component. This flaw allows a remote peer to send repeated valid RESERVE requests, causing unbounded growth of listeners and closures in @libp2p/circuit-relay-v2 relay servers, leading to denial of service. The issue is fixed in version 4.2.9.
CVE-2026-48050 is a high-severity vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The issue arises because the application registers Go's pprof debugging endpoints under /debug/pprof/* without proper authentication, allowing unauthorized access to sensitive profiling information. This exposure occurs due to the authentication middleware bypassing token checks for these endpoints. The vulnerability is patched in version 26.06.1. Workarounds include blocking access to /debug/pprof* at the reverse proxy or load balancer, restricting API port access via firewall rules, or disabling the pprof handler in the source code and rebuilding the application.
RaTeX versions prior to 0.1.11 contain a vulnerability where deeply nested LaTeX input causes uncontrolled recursion in the parser, leading to stack overflow and process abort. This results in a denial of service triggered by a crafted LaTeX string. The issue is fixed in version 0.1.11.
RaTeX versions prior to 0.1.11 contain a vulnerability where the parser panics and aborts the process when handling a specific malformed input involving a multibyte UTF-8 delimiter in the \verb command. This results in a denial of service by crashing the entire process rendering untrusted LaTeX. The issue is fixed in version 0.1.11.
CVE-2026-77354 is a high-severity vulnerability in the Go project kin-openapi affecting versions from 0.124.0 up to but not including 0.142.0. The issue involves uncontrolled resource consumption caused by the openapi3filter.sliceMapToSlice function, which allocates large slices based on attacker-controlled sparse indexes in deepObject query parameters before schema validation. This can lead to multi-gigabyte heap allocations, resulting in out-of-memory (OOM) kills or restart loops. The vulnerability is fixed in version 0.142.0.
CVE-2026-55241 is a high-severity vulnerability in bluewave-labs Checkmate prior to version 3.9.1. It involves uncontrolled resource consumption via the public POST /api/v1/auth/register endpoint, which processes multipart profile image uploads without limits on file size, count, or MIME type. An unauthenticated attacker can submit concurrent oversized files that are buffered in memory before registration validation, leading to memory exhaustion and potential backend crashes or destabilization. This issue is fixed in version 3.9.1.
CVE-2026-77755 is a denial-of-service vulnerability in misp-stix affecting versions up to and including 2026.7.8. It arises from improper handling of STIX 1 and STIX 2 documents during import, where sys.exit() calls cause process termination and no input size limits allow excessive memory and CPU consumption. Exploitation can terminate the importer process or degrade service availability.
CVE-2026-19446 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It allows a remote unauthenticated attacker to send a crafted UDP packet to a reachable RPC service, causing uncontrolled resource consumption that results in complete system unavailability and requires an LPAR restart.
CVE-2026-18822 is a medium severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption during the parsing of directory records by a local attacker, potentially causing a denial of service. The vulnerability requires high privileges and does not impact confidentiality or integrity. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.