OpenReception's appointment booking software prior to version 1.0.6 has a weakness in its rate-limiting mechanism for unauthenticated clients. The proof-of-work challenge used as a rate limiter is set to a difficulty level that modern hardware can solve very quickly, making it ineffective against automated abuse. Additionally, the throttle mechanism can be bypassed by attackers supplying attacker-controlled values, allowing them to evade per-binding throttling. Version 1.0.6 addresses this issue.
A denial of service vulnerability exists in the python-multipart library used for parsing multipart/form-data requests. The flaw allows an attacker to cause excessive CPU usage by sending requests with many repeated headers without termination or a single very large header value. This affects ASGI applications using frameworks like Starlette or FastAPI that rely on python-multipart. The issue is mitigated by upgrading to python-multipart version 0.0.27 or later. If immediate upgrade is not possible, limiting request body size at the server or proxy can reduce exposure but does not fully resolve the vulnerability.
Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not impose a default limit on the maximum attachment size, which can lead to denial of service (DoS) attacks if users do not explicitly configure this limit. The issue is addressed by setting a default attachment size limit of 50MB in the fixed versions.
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
CVE-2026-59675 is a high-severity vulnerability in SUSE Rancher versions 2.12.0, 2.13.0, and 2.14.0. When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without size limits on login endpoints, bypassing the intended 1 MiB cap. This allows an unauthenticated attacker to send very large request bodies, causing excessive memory consumption and potential denial of service by crashing the Rancher Manager process, which disrupts API and UI availability and management of downstream clusters.
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
A resource allocation vulnerability exists in Apache Qpid Proton-Dotnet through version 1.0.0, where the maximum number of transfer frames per incoming delivery could not be limited. This flaw allows an authenticated attacker to cause excessive resource consumption, potentially leading to denial of service. The issue is fixed in version 1.1.0.
Apache Qpid Broker-J versions up to and including 10.0.1 contain a vulnerability where the maximum number of transfer frames per incoming delivery cannot be governed. This allows an authenticated attacker to cause excessive resource usage, potentially leading to denial of service. The issue is fixed in version 10.1.0.
Apache Qpid Proton-J versions up to 0.34.1 have a vulnerability where the maximum number of transfer frames per incoming delivery is not limited. This allows an authenticated attacker to cause excessive resource consumption, potentially leading to denial of service. The issue is fixed in version 0.35.0.
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.
Users are recommended to upgrade to version 1.1.0, which fixes the issue.
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.0.1.
Users are recommended to upgrade to version 10.1.0, which fixes the issue.
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.0.1.
Users are recommended to upgrade to version 10.1.0, which fixes the issue.
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.
Users are recommended to upgrade to version 1.1.0, which fixes the issue.
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.0.1.
Users are recommended to upgrade to version 10.1.0, which fixes the issue.
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller. As a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes. The equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase. Impact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed. This issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08).
CVE-2026-18401 is a medium severity vulnerability in FasterXML jackson-core affecting the asynchronous JSON parser. The async parser does not enforce the maxNumberLength constraint, allowing an attacker to submit JSON with arbitrarily long number tokens. This leads to excessive memory allocation and potential CPU exhaustion, causing denial of service. The synchronous parser is not affected as it enforces this limit correctly. No privileges or user interaction beyond submitting JSON data are required. The issue affects jackson-core versions 2.15.0 through 2.18.5, 2.19.0 through 2.21.0, and 3.0.0 through 3.0.x. Patch status is not confirmed; no official fix or remediation level is stated in the vendor advisory.