CWE-770: Unthrottled Resource Allocation vulnerabilities

A vulnerability in Undertow's handling of WebSocket connections allows certain configuration limits, such as message buffer sizes and session timeouts, to default to unlimited. This flaw enables remote attackers to send large amounts of data or maintain connections indefinitely, potentially exhausting server resources and causing a crash. The issue affects multiple specific versions of Undertow. The CVSS score is 7.5, indicating a medium severity impact focused on availability.

CVE-2026-82722 is a high-severity vulnerability in ash-project's ash_admin component that allows any client able to reach the admin LiveView to exhaust the BEAM atom table and crash the entire Erlang VM node. The issue arises because two LiveView event handlers intern atoms from unvalidated client input, which leads to unbounded atom creation. Since atoms are not garbage collected and the atom table has a fixed size, flooding these handlers with random input causes the VM to abort. This vulnerability affects ash_admin versions from 0.1.0 up to but not including 1.3.1.

CVE-2026-81636 is a high-severity vulnerability in ash-project's ash_graphql component that allows unauthenticated clients to bypass GraphQL query complexity limits. This flaw arises because the query complexity calculation does not properly account for Relay connection pagination parameters (first and last), enabling unbounded database reads. The issue affects versions from 0.16.23 up to but not including 1.11.0. No official patch or remediation guidance is currently confirmed.

CVE-2026-82562 is a vulnerability in the ljharb qs library versions 6.14.2 through 6.15.3 where the array size limit enforcement for comma-separated values does not apply to parameters using the bracket-push key form (e.g., a[]=1,2,3,4). This allows an attacker to bypass the configured array size limit and cause the parser to allocate large arrays proportional to the input size. The issue is fixed in version 6.16.0.

IBM Cloud Pak for Data System version 11.3.0.2 is affected by a vulnerability that allows denial of service due to improper limitation of resource allocation. This issue can cause the system to exhaust resources, leading to service disruption. The vulnerability has a medium severity rating with a CVSS score of 6.2. No official patch or remediation guidance has been provided yet by IBM.

CVE-2026-54788 is a high-severity vulnerability in DataDog's dd-trace-rs Rust library for application performance monitoring. Versions from 0.1.0 up to but not including 0.3.3 parse the W3C tracestate header and collect all semicolon-separated key-value pairs in the Datadog dd=... vendor entry into a HashMap without limits. This allows a remote unauthenticated attacker to send an arbitrarily large dd=... entry, causing excessive CPU and memory consumption and resulting in denial of service. The issue is fixed in version 0.3.3.

CVE-2026-81285 is a high-severity vulnerability in WPMU DEV's Smush Image Compression and Optimization plugin versions up to 4.2.0. It allows unauthenticated attackers to cause a denial of service by allocating resources without limits or throttling. This vulnerability does not impact confidentiality or integrity but can disrupt availability.

CVE-2026-58107 is a medium severity vulnerability in Ericsson CodeChecker where the massStoreRun processing path decompresses attacker-controlled Base64-encoded zlib data without limiting the decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands significantly in memory, potentially exhausting process or host memory and disk space, causing denial of service.

CVE-2026-59303 is a low severity vulnerability in Spring Cloud Stream where the dynamic destination cache size is not properly bounded. This issue affects multiple versions of Spring Cloud Stream, including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The flaw relates to allocation of resources without limits or throttling (CWE-770), potentially leading to resource exhaustion. No official patch or remediation guidance is currently available.

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVE-2026-5680 is a vulnerability in Undertow used by Red Hat JBoss Enterprise Application Platform 8.1.8.GA. It allows a remote attacker to cause excessive memory consumption by sending specially crafted WebSocket messages with permessage-deflate negotiated. This leads to a denial of service (DoS) due to uncontrolled resource allocation in the PerMessageDeflateFunction.largerBuffer() method.

CVE-2026-80212 is a high-severity vulnerability in the Ruby resolv gem before version 0.7.2. It involves uncontrolled allocation of resources when decoding DNS responses containing unknown resource record types or service parameter keys. This causes permanent memory growth as new classes are dynamically generated and retained indefinitely, leading to potential denial of service via memory exhaustion. The issue affects any code path calling Resolv::DNS::Message.decode on attacker-influenced DNS responses. The resolv gem is included by default in Ruby installations, making this vulnerability broadly reachable.

CVE-2026-47891 is a critical vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves the Spring WebFlux application using the Aalto XML processor, which fails to properly enforce the maxInMemorySize limit. This can lead to uncontrolled resource allocation during XML parsing, potentially causing denial of service or other impacts.

CVE-2026-47885 is a high-severity vulnerability in the Spring Framework's WebFlux module affecting versions 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The issue arises because the PartEventHttpMessageReader does not enforce the maxPartSize limit when maxInMemorySize is set to -1, leading to allocation of resources without limits or throttling. This flaw could potentially allow resource exhaustion attacks. No official patch or remediation guidance has been confirmed yet.

CVE-2026-47874 is a medium severity vulnerability in Spring Reactor Netty where HTTP/1.1 pipelined requests over a single connection can cause excessive memory consumption. This affects multiple versions of Reactor Netty, including 1.0.52 and earlier, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. The issue is related to allocation of resources without limits or throttling (CWE-770). No official patch or remediation guidance is currently provided.

CVE-2026-47859 is a medium severity vulnerability in Spring Integration's syslog TCP inbound adapter. The RFC6587SyslogDeserializer component trusts the sender-supplied octet count for octet-counted frames and allocates a byte array of that exact size without any upper limit. This can lead to uncontrolled resource allocation. The affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation guidance is currently available.

CVE-2026-61617 affects Pterodactyl Wings up to and including version 1.13.2. The vulnerability allows a tenant with SFTP write access to bypass disk quota enforcement during file transfers, potentially exhausting the host node's physical disk space. This occurs because Wings only checks available disk space once when the write handle is opened, using a stale cached value and without accounting for the size of incoming data. As a result, uploads can exceed configured disk limits, causing denial of service by filling the disk. The issue is fixed in version 1.13.3.

CVE-2026-79921 is a vulnerability in the amqp091-go client library used by RabbitMQ. A malicious AMQP broker can send content body frames larger than the negotiated frame_max limit, causing the client to allocate excessive memory. This bypasses the protocol's framing constraints and can lead to denial of service due to out-of-memory conditions.

A denial of service vulnerability (CVE-2026-4897) exists in the polkit-agent-helper-1 component of polkit, affecting multiple versions of Red Hat Enterprise Linux 10 and related distributions. The flaw is due to unbounded input processing via standard input, which can lead to resource exhaustion and an out-of-memory condition. Red Hat has rated this issue as moderate severity and has released a security update to address it.