CWE-401: Memory Leak vulnerabilities

CVE-2026-110677 is a high-severity memory leak vulnerability in Cpanel::JSON::XS versions from 4.28 up to but not including 4.80 for Perl. The flaw occurs when decoding JSON objects with duplicate keys using the dupkeys_as_arrayref option, which collects duplicate key values into an array but fails to release an extra reference. This causes the array and its values to persist beyond the decoded structure's lifetime, leading to memory exhaustion if exploited repeatedly with large values. The issue also causes leaks when decoding fails after encountering duplicate keys. The vulnerability is fixed in version 4.80.

CVE-2026-110672 is a high-severity memory leak vulnerability in Cpanel::JSON::XS for Perl versions before 4.80. The flaw occurs when decoding JSON objects with duplicate keys or missing colons, causing the decoded key to be leaked in memory. This leak happens because the scalar allocated for the key is not freed when the object is rejected. A process that repeatedly decodes such malformed JSON documents can exhaust its memory over time.

Text::CSV_XS versions before 1.65 for Perl contain a memory leak vulnerability where parsed fields of a malformed CSV record are not freed after a failed parse attempt in the getline method. This causes memory exhaustion in long-running processes that repeatedly parse malformed CSV input.

CVE-2026-102053 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms. It involves improper release of memory before removing the last reference in the l2ald process, which can be triggered by a configured EVPN peer. This flaw allows denial of service through memory exhaustion during EVPN-VXLAN active-active multihoming route processing.

CVE-2026-102051 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved platforms affecting the l2cpd process. It involves improper release of memory before removing the last reference, which can be triggered by an adjacent unauthenticated attacker via LLDP traffic when fast receive processing is enabled. This can cause memory exhaustion in l2cpd and disrupt Layer 2 control-plane operations.

CVE-2026-102032 is a medium severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved involving improper memory release in the l2ald process when the static MAC-IP feature is enabled. An unauthenticated adjacent attacker can exploit this flaw by sending crafted packets to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. Multiple affected versions across various Junos OS releases are identified. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

CVE-2026-102081 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX and MX Series devices. It involves a memory leak in the packet forwarding engine (PFE) when certain application services are configured and a high connection churn occurs. This can lead to exhaustion of PFE memory and cause a complete denial-of-service (DoS). The issue affects specific Junos OS versions from 23.4R2-S3 up to but not including 23.4R2-S7, 24.2R2 up to but not including 24.2R2-S3, 24.4 up to but not including 24.4R2-S3, and version 25.2. A patch is available to address this vulnerability.

F5 NGINX JavaScript (njs) contains a memory leak vulnerability in its built-in njs engine where a libxml2 parser context is not released when xml.parse() fails. This can lead to unbounded memory growth in long-lived NGINX worker processes, potentially causing worker termination or denial of service. The issue affects versions from 0.7.10 up to but not including 1.0.2. The vulnerability is exploitable remotely without authentication and does not impact confidentiality or integrity, only availability. There is no control plane exposure; the issue is limited to the data plane.

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the wavelet-denoise operation. The flaw occurs because allocated memory is not released when a required resource cannot be acquired, potentially allowing attackers to degrade service availability by triggering repeated wavelet-denoise processing under resource constraints.

ImageMagick versions 7.0.0-0 contain a memory leak vulnerability in the -process option. This flaw allows attackers with limited privileges to cause unreleased memory allocations by supplying crafted arguments, potentially leading to gradual memory exhaustion and degraded service availability.

A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the YUV encoder. The flaw occurs when the encoder fails to release allocated memory after a specific operation fails, potentially allowing attackers to exhaust system resources and cause a denial of service.

A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the SVG encoder component. This flaw causes allocated memory to not be released properly when processing crafted SVG images, potentially leading to denial of service through resource exhaustion.

CVE-2026-109261 is a memory leak vulnerability in ImageMagick's GIF encoder affecting versions before 6.9.13-57 and 7.x before 7.1.2-32. The issue occurs when color quantization fails during GIF encoding, causing allocated memory not to be released. This can be exploited by attackers supplying crafted images that trigger quantization failure, leading to memory exhaustion and degraded availability.

A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the PNG encoder. The flaw occurs when libpng initialization fails during PNG encoding, causing allocated memory not to be released. Repeated triggering of this failure can exhaust system memory and result in a denial of service.

CVE-2026-104874 is a medium severity memory leak vulnerability in aio-libs/multidict versions 6.7.0 through 6.9.0. It occurs in the items-view union and subtraction operators, where certain references are not properly released, causing unbounded memory growth. This leak can be triggered remotely by supplying crafted HTTP headers or query strings to servers using the affected library. The issue results in increasing resident memory usage until the process is terminated.

CVE-2026-94652 is a memory management vulnerability in the Apache Thrift C++ bindings where memory is not released after its effective lifetime. This issue affects versions before 0.25.0. The vulnerability has a medium severity rating and is addressed in Apache Thrift version 0.25.0.