MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
CVE-2026-57099 is a high-severity vulnerability in Microsoft AspNetCore.OData where allocation of resources occurs without limits or throttling. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting resources. The issue affects versions from 9.0.0 up to but not including 7.8.1. An official fix is available in version 7.8.1.
CVE-2026-69374 is a vulnerability in Microsoft Windows 10 Version 21H2 SMB Server where resource allocation occurs without proper limits or throttling. This flaw allows an authorized attacker to cause a denial of service over the network. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-72978 is a vulnerability in Microsoft Windows 10 Version 1607 involving allocation of resources without limits or throttling in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to cause a denial of service over a network. The issue affects multiple Windows 10 builds and related versions, and has been assigned a medium severity rating with a CVSS score of 5.9. Microsoft has released official fixes for all affected versions.
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
CVE-2026-62649 is a high-severity vulnerability in Siemens Reyrolle 7SR5 affecting all versions prior to 2.70. The device's web server does not properly limit system resource usage when handling many concurrent HTTP requests, allowing an unauthenticated remote attacker to cause a denial-of-service by crashing and rebooting the device.
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount of memory.Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
CVE-2026-82753 is a resource exhaustion vulnerability in ash-project's ash_authentication_oauth2_server affecting versions from 0.3.0 up to but not including 0.3.1. An unauthenticated attacker can exploit the /authorize endpoint to create many client entries with large data fields, causing unbounded growth in database storage and memory usage. This occurs because the system lacks limits, expiry, or garbage collection for client rows created from client ID Metadata Documents, and caches documents before validation, including rejected ones.
CVE-2025-52657 is a low-severity vulnerability in HCL Software MyXalytics involving allocation of resources without limits or throttling. It allows users to input data without restrictions on the number of characters, potentially impacting system performance or availability. There is no evidence of confidentiality or integrity impact. No patch or remediation information is currently available.
CVE-2026-19204 is a high-severity vulnerability in Eclipse Jetty where a client can send a WebSocket frame with an unknown opcode and a very large declared payload length. This causes Jetty to allocate a large amount of memory, potentially exhausting the JVM heap. The issue arises when auto-fragmentation is enabled, as unknown opcodes bypass normal frame size checks and payload allocation happens before opcode validation.
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.
This issue affects mint: from 0.1.0 before 1.10.0.
Robots::Validate Perl module versions from 0.3.2 up to but not including 0.3.11 contain a vulnerability where unbounded outbound DNS queries can be triggered during validation. This occurs due to a forward-confirmation loop in the _check_dns function that does not limit the number of DNS names queried. An attacker controlling the reverse DNS zone for a client IP can cause the module to issue many synchronous DNS queries, potentially leading to resource exhaustion. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-78662 is a high-severity vulnerability in the golang.org/x/crypto/ssh package. It allows a malicious peer to flood incoming requests on a channel before it is fully established, causing a deadlock of the entire connection. The root cause is the lack of limits or throttling on resource allocation for channels registered but not yet usable. The vulnerability is addressed by adding an atomic established state to drop packets other than open confirmation or failure until the channel is usable, preventing blocking or connection teardown.
CVE-2026-56855 is a high-severity vulnerability in the golang.org/x/crypto/ssh package that allows a malicious peer to cause a deadlock in an SSH connection by sending crafted messages after the SSH channel is established. The issue arises because the package buffers unexpected messages instead of treating them as protocol errors, leading to blocking behavior. The vulnerability is addressed by explicitly handling all RFC 4254 channel messages and terminating connections upon receiving unexpected messages.