CVE-2026-53965 is a medium severity vulnerability in the Model Context Protocol PHP SDK (mcp/sdk) versions 0.5.0 through 0.7.0. The HTTP client transport reads Server-Sent Events (SSE) streams into an unbounded in-memory buffer, which only flushes upon receiving a double newline delimiter. A malicious or compromised server that never sends this delimiter can cause the buffer to grow indefinitely, exhausting client memory and causing a denial of service. This affects any client using HttpTransport against an untrusted server and requires no authentication or user interaction beyond connection initiation. The issue is fixed in version 0.7.1.
CVE-2026-55620 is a high-severity vulnerability in the GOVCERT-LU eml_parser Python module prior to version 3.0.2. The flaw involves a regex-based fix-point loop in the function eml_parser.routing.noparenthesis that removes parenthesized comments from Received: headers. This loop has quadratic time complexity relative to the nesting depth of parentheses, causing excessive CPU consumption when processing emails with deeply nested parentheses. An attacker can exploit this by submitting crafted EML files with deeply nested parentheses, leading to significant processing delays and potential denial of service in synchronous email processing systems. The issue is fixed in version 3.0.2. No official patch advisory or exploit reports are currently available.
CVE-2026-55619 is a medium severity vulnerability in the GOVCERT-LU eml_parser Python module prior to version 3.0.2. The issue arises from the HeaderParser.header_fetch_parse function using email.utils.getaddresses() to parse email headers. A deeply nested CFWS comment construct can cause the standard library's recursive parser to exhaust the call stack, raising an uncaught RecursionError and aborting the parsing of the entire message. This can disrupt security operations center (SOC) pipelines processing untrusted EML files. The vulnerability is fixed in eml_parser version 3.0.2.
CVE-2026-55531 is an uncontrolled resource consumption vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the MCP HTTP Stream mcp_post handler creates a new session entry for every initialize request without cleaning up old sessions or enforcing a maximum limit. This allows an unauthenticated attacker to exhaust memory resources. The issue is fixed in version 4.6.58 by invoking session cleanup and limiting the number of sessions via PRAISONAI_MCP_MAX_SESSIONS.
CakePHP Authentication versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 contain a vulnerability that allows authentication bypass and potential CPU or memory exhaustion when using the CookieAuthenticator with unencrypted, forgeable legacy tokens. This issue is resolved in versions 2.11.2, 3.3.7, and 4.2.1.
CVE-2026-78321 is a denial-of-service vulnerability in the HTTP media server of multiple DJI drone models. The server does not enforce limits on incoming connections or request rates, allowing an attacker on the drone's internal network to exhaust connection resources by repeatedly requesting stored media files. This prevents legitimate requests and blocks the DJI Fly app from retrieving photos and videos in QuickTransfer mode. A firmware update from DJI is required to remediate this issue.
CVE-2026-55241 is a high-severity vulnerability in bluewave-labs Checkmate prior to version 3.9.1. It involves uncontrolled resource consumption via the public POST /api/v1/auth/register endpoint, which processes multipart profile image uploads without limits on file size, count, or MIME type. An unauthenticated attacker can submit concurrent oversized files that are buffered in memory before registration validation, leading to memory exhaustion and potential backend crashes or destabilization. This issue is fixed in version 3.9.1.
CVE-2026-59323 is a medium severity vulnerability in Spring Micrometer Tracing that allows denial of service (DoS) due to unbounded resource allocation when processing incoming baggage headers with W3C baggage propagation in the Brave bridge. This affects multiple versions including 1.7.0, 1.6.0 through 1.6.6, 1.5.0 through 1.5.12, and versions up to 1.4.13. The flaw is related to allocation of resources without limits or throttling, potentially causing service disruption.
CVE-2026-17170 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper validation of allocation size, which could allow a remote attacker to cause a denial of service by exhausting system resources.
CVE-2026-17163 is a high severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper validation of an array size field, which could allow a remote attacker to cause a denial of service by exhausting system resources. The vulnerability is classified under CWE-770, indicating allocation of resources without limits or throttling. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-67447 is a medium severity vulnerability in axllent mailpit's SMTP DATA reader. The configured maximum message size limit is enforced only after a complete newline-terminated line is buffered, allowing a remote unauthenticated SMTP client to send a single line larger than the limit. This causes excessive memory allocation before the server rejects the message, potentially leading to resource exhaustion. The issue is a partial regression of a previous SMTP DATA body-size limit fix, affecting versions from 1.30.0 up to but not including 1.30.5.
CVE-2026-67446 is an uncontrolled resource consumption vulnerability in axllent mailpit's thumbnail endpoint. The endpoint decodes attacker-supplied image attachments into full raster images before validating their dimensions or memory usage, allowing a remote client to cause excessive CPU and memory consumption. This can be triggered by supplying a compact but high-dimension image attachment and requesting its thumbnail, which forces the server to decode a large image in memory. The vulnerability affects mailpit versions prior to 1.30.4. The CVSS score is 5.3, indicating a medium severity impact primarily on availability.
CVE-2026-74836 is a high-severity vulnerability in mtrudel bandit affecting versions from 0.3.4 up to but not including 1.12.5. It involves allocation of resources without limits or throttling in the HTTP/2 connection-level flow control. An unauthenticated remote attacker can cause indefinite blocking of HTTP/2 stream processes by exploiting the unbounded queuing of response bytes exceeding the connection-level send window. This leads to resource exhaustion as each stalled stream pins its process and associated resources indefinitely. The vulnerability allows repeated exploitation across multiple streams and connections, potentially causing denial of service.
CVE-2026-53585 is a medium severity vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5. The flaw involves the git_delta_apply function trusting an attacker-controlled size value from a delta object header, leading to uncontrolled memory allocation. This can cause memory exhaustion when processing malicious pack data via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or local repository operations. The issue is fixed in libgit2 versions 1.8.6 and 1.9.5.
Libevent versions from 2.2.0-alpha-dev up to but not including 2.2.2-alpha contain a vulnerability in the WebSocket server implementation where fragmented frames are accumulated without a total message-size limit. An unauthenticated remote attacker can exploit this by sending many fragmented WebSocket frames with FIN=0, causing unbounded memory growth and potential exhaustion of system memory. This issue is fixed in version 2.2.2-alpha.
A vulnerability in FreeIPA on Red Hat Enterprise Linux 9 allows a remote unauthenticated attacker to cause a denial of service by sending oversized POST requests to the /ipa/migration/migration.py endpoint. This results in excessive memory consumption and potential service disruption. Red Hat has issued a critical security advisory with a fix available in Red Hat Enterprise Linux 9.8. The vulnerability has a CVSS score of 7.5, indicating high severity.
CVE-2026-73198 is a high-severity vulnerability in FreeIPA on Red Hat Enterprise Linux 9 that allows an unauthenticated remote attacker to cause a denial of service by sending an arbitrarily large request body to the /ipa/i18n_messages endpoint. This leads to excessive memory consumption and degraded service responsiveness. Red Hat has issued a critical security advisory with an update that fixes this issue in Red Hat Enterprise Linux 9.8 and related packages.
IBM Reliable Scalable Cluster Technology (RSCT) version 3.0 contains a vulnerability where improper input validation allows a remote attacker to cause a denial of service by allocating resources without limits or throttling. This vulnerability is identified as CWE-770 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-61712 is a low-severity vulnerability in moby buildkit prior to version 0.31.1. The issue involves BuildKit reading attacker-controlled /etc/passwd and /etc/group files without limits while resolving user and group identifiers. Maliciously crafted oversized files can exhaust memory and cause the buildkitd process to terminate due to out-of-memory conditions. This vulnerability has been fixed in version 0.31.1.
Snipe-IT versions prior to 8.6.1 have a vulnerability in the two-factor authentication implementation. The POST /two-factor endpoint lacks rate limiting or attempt counters, allowing unlimited TOTP guesses with valid credentials. This can lead to unauthorized session creation if a guess is successful. Additionally, two-factor authentication can be disabled without OTP verification under certain configurations, and administrators can reset other users' two-factor secrets via the API. The issue is fixed in version 8.6.1.