CVE-2026-93849 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. The issue arises from a failure to apply allocation limits in the WebSocket msgpack decoder's byte-string decode paths. This allows an authenticated remote attacker to cause excessive server memory allocation by sending a crafted binary WebSocket frame with a Bin32 payload length up to 4,294,967,295 bytes. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-115825 is a high-severity vulnerability in HTTP::Server::PSGI versions before 1.0056 used by Plack for Perl. It allows a remote attacker to crash the server by sending a request with a large Content-Length header, causing excessive memory allocation and an out-of-memory error. The server runs as a single process, so it remains down until manually restarted.
CVE-2026-114629 is a high-severity vulnerability in Web::Simple for Perl versions before 0.035. It involves excessive memory allocation based on the Content-Length header for urlencoded body parameters. An attacker can send a large Content-Length value to cause the application to allocate a large buffer, potentially leading to resource exhaustion. No authentication is required to exploit this issue. The vulnerability is fixed in version 0.035.
A vulnerability in the MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt before version 0.16.2 allows remote attackers to cause a denial of service by triggering memory allocation with an excessive size value. This issue is fixed in version 0.16.2.
CVE-2026-108359 is a high-severity vulnerability in PHPOffice PhpSpreadsheet affecting multiple versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The vulnerability arises from the Ods::processTableRow function accepting an unbounded table:number-rows-repeated attribute in ODS files, allowing an attacker to cause uncontrolled resource consumption. This can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. The issue is fixed in the specified versions.
CVE-2026-56387 is a high-severity vulnerability in Apache bRPC's RTMP AMF parser that allows remote unauthenticated attackers to cause excessive memory allocation or resource consumption by sending crafted AMF payloads with large declared string lengths or array counts. This occurs because the parser resizes buffers based on unvalidated length fields before verifying the actual payload size. The issue affects bRPC versions prior to 1.18.0 when RTMP is enabled and exposed to untrusted clients. The vulnerability is fixed in version 1.18.0, which introduces configurable limits on maximum string size and array element count to prevent excessive resource use.
Pillow, a Python imaging library, has a vulnerability in versions from 8.1.0 up to but not including 13.0.0 where it can allocate excessive memory when processing crafted APNG images. This occurs because the library allocates memory for a full canvas size before performing decompression-bomb checks, potentially leading to memory exhaustion and denial of service. The issue is fixed in version 13.0.0.
CVE-2026-85324 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving memory allocation with an excessive size value in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to cause a denial of service over the network. The vulnerability affects multiple Windows versions and has been officially fixed in specific updates.
CVE-2026-33374 is a vulnerability in Grafana Enterprise affecting the Prometheus rule conversion API endpoints. These endpoints do not limit the size of the request body, allowing authenticated users to cause unbounded memory allocations. This can lead to out-of-memory conditions that crash the server. The vulnerability affects multiple versions of Grafana Enterprise from 12.0.0 through versions prior to 12.3.12, 12.4.0 through prior to 12.4.13, 13.0.0 through prior to 13.0.11, 13.1.0 through prior to 13.1.8, and 13.2.0 through prior to 13.2.4. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
ConnectBot SSH Client Library versions prior to 0.3.1 contain an improper input validation vulnerability in the SSH protocol parser. The parser trusts attacker-controlled inner byte lengths and element counts without verifying they fit within the containing packet. This can cause excessive memory allocation attempts leading to an uncaught OutOfMemoryError, terminating the application process. There is no demonstrated impact on confidentiality or integrity. The issue is fixed in version 0.3.1.
CVE-2026-97853 is a memory allocation vulnerability in the ericmj decimal library affecting versions from 0.1.0 up to but not including 3.1.2. The Decimal.round/3 function allocates memory proportional to the 'places' argument before applying context precision, allowing excessive memory use. For example, calling Decimal.round with a large negative places value can allocate multiple gigabytes of memory, potentially causing denial of service by exhausting system memory and terminating the BEAM VM. This issue arises when user-supplied decimal places are not properly bounded.
A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows an attacker to cause excessive memory allocation by providing a crafted MP4 file with an oversized 64-bit extended atom size. This can lead to denial of service due to process failure or resource exhaustion during parsing of certain MP4 atoms. The issue is fixed in version 11.16.0.
A vulnerability in Borewit's music-metadata prior to version 11.16.0 allows an attacker to cause excessive memory allocation by manipulating the length of VINT elements in Matroska and WebM EBML parsers. This can lead to out-of-memory denial of service or a fatal abort in Node.js 26.7.0. The issue is fixed in version 11.16.0.
A vulnerability in Borewit's music-metadata library prior to version 11.16.0 allows excessive memory allocation due to trusting the syncsafe tag-size field in ID3v2 tags. This can cause the parser to allocate up to approximately 268 MiB of memory for a truncated file, leading to a denial of service condition. The issue is fixed in version 11.16.0.
music-metadata version 11.15.0 contains a vulnerability in its APEv2 tag parser where it allocates memory based on an untrusted size value without verifying that the declared size fits within the actual file data. This can lead to excessive memory allocation and potential denial of service. The issue is limited to availability impact and does not affect confidentiality or integrity. The vulnerability is fixed in versions after 11.15.0.
CVE-2026-107223 is a high-severity vulnerability in the qax-os excelize Go library for handling Microsoft Excel spreadsheets. Versions from 2.1.0 through 2.11.0 are affected. The flaw arises because the library's flatCols function expands column ranges without validating the Min and Max column indices against the worksheet's column limit. An attacker can craft a worksheet with an excessively large column max attribute, causing the library to allocate excessive memory and CPU during column mutation operations, potentially leading to out-of-memory conditions. No official fix or patch is currently available.
CVE-2026-107215 is a high-severity vulnerability in the qax-os excelize Go library for Microsoft Excel spreadsheets. Versions from 2.3.1 up to and including 2.11.0 improperly allocate memory based on attacker-controlled size values from OLE compound file streams without proper validation. This can lead to excessive memory allocation or negative length allocations, causing process crashes or memory exhaustion. No patch or fixed version is currently available.
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.