CWE-400: Uncontrolled Resource Consumption vulnerabilities

CVE-2026-17121 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled recursion that can be triggered remotely, leading to denial of service (DoS) conditions. The vulnerability does not impact confidentiality or integrity but results in service disruption. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

CVE-2026-16952 is a medium severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a local attacker to cause a denial of service by uncontrolled resource consumption. The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-67446 is an uncontrolled resource consumption vulnerability in axllent mailpit's thumbnail endpoint. The endpoint decodes attacker-supplied image attachments into full raster images before validating their dimensions or memory usage, allowing a remote client to cause excessive CPU and memory consumption. This can be triggered by supplying a compact but high-dimension image attachment and requesting its thumbnail, which forces the server to decode a large image in memory. The vulnerability affects mailpit versions prior to 1.30.4. The CVSS score is 5.3, indicating a medium severity impact primarily on availability.

Mailpit's SMTP server has an uncontrolled resource consumption vulnerability due to unbounded reading of SMTP command lines. The server reads command lines without enforcing the RFC 5321 limit of 512 octets, allowing a remote unauthenticated client to send oversized commands that cause large memory allocations. This can lead to denial of service by exhausting process memory. The issue affects versions prior to 1.30.4.

Libevent versions from 2.2.0-alpha-dev up to but not including 2.2.2-alpha contain a vulnerability in the WebSocket server implementation where fragmented frames are accumulated without a total message-size limit. An unauthenticated remote attacker can exploit this by sending many fragmented WebSocket frames with FIN=0, causing unbounded memory growth and potential exhaustion of system memory. This issue is fixed in version 2.2.2-alpha.

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732

CVE-2026-69222 is a high-severity vulnerability in harttle liquidjs, a JavaScript template engine. Prior to version 10.27.2, certain filters (join and array_to_sentence_string) incorrectly calculate resource usage, allowing crafted templates to cause excessive memory consumption. This can lead to process crashes due to exceeding memory limits. The issue is fixed in version 10.27.2.

CVE-2026-68555 is a resource exhaustion vulnerability in coturn versions 4.15.0 up to but not including 4.16.0. An authenticated TURN user can repeatedly resume one allocation without completing a handoff when the server mobility feature is enabled, causing unbounded server-side sessions and memory exhaustion. This occurs because the allocation timeout is disarmed and earlier pending sessions become unreachable by cleanup, bypassing the configured user quota. The issue is fixed in coturn version 4.16.0.

CVE-2026-16837 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption due to improper handling of a missing SSL client certificate, which could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but results in service disruption.

CVE-2026-16836 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption that could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. There is no information provided about patches or fixes.

CVE-2026-16831 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption that could be triggered remotely, leading to a denial of service condition. The vulnerability does not impact confidentiality or integrity but results in service disruption.

CVE-2026-19507 is a high-severity vulnerability in the RDK-B WebUI component of the RDK project. It involves uncontrolled resource consumption in the check.jst file, allowing a remote unauthenticated attacker to cause a denial of service by submitting excessively large password values. This vulnerability does not impact confidentiality or integrity but results in availability disruption.

CVE-2026-16824 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption caused by unbounded recursion, which can be triggered remotely and lead to a denial of service condition.

CVE-2026-19653 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, where improper handling of memory page table configurations can lead to uncontrolled resource consumption. This flaw allows a local attacker to cause a denial of service by exhausting system resources. The vulnerability has a medium severity rating with a CVSS score of 6.5. There is no indication of known exploits in the wild or available patches at this time.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

A vulnerability in the SimpleSAMLphp SAML2 PHP library allows remote unauthenticated attackers to cause a denial of service via uncontrolled resource consumption. This occurs because attacker-controlled XPath transforms are permitted during XML signature processing in certain versions. The issue is fixed by limiting transforms to those specified in the SAML 2.0 Core specification and rejecting XPath transforms. Fixed versions are 4.19.3 and 4.20.3.

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.

CVE-2026-71486 is a medium severity vulnerability in vllm-project vllm versions prior to 0.26.0. It affects the /v1/completions/derender and /v1/chat/completions/derender API endpoints, which accept client-supplied generated output data without enforcing limits on token counts or response sizes. This allows an authenticated API client to cause uncontrolled CPU and memory consumption proportional to the size of the attacker-supplied token data, bypassing normal generation output bounds.