The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range.
A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website.
The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.
CVE-2026-13586 is a medium severity vulnerability in Bouncy Castle for Java (BC-JAVA) involving allocation of resources without limits or throttling. It affects PKCS#12 MAC and bag-decryption KDF iteration-count bounds, potentially leading to denial of service (DoS). The flaw exists in versions before 1.85, 2.73.12, and specific versions of the BC-FIPS series. Fixed versions are available.
CVE-2026-58063 is a medium severity vulnerability in Bouncy Castle for Java (BC-JAVA) affecting multiple versions before 1.85 and corresponding LTS and FIPS releases. The issue involves unbounded key derivation function (KDF) cost parameters loaded from untrusted BCFKS keystore files, leading to allocation of resources without limits or throttling.
CVE-2026-20482 is a medium severity vulnerability in MediaTek chipset WLAN STA firmware that can cause the system to become unresponsive due to uncontrolled logging. This issue can be exploited remotely by an adjacent attacker without requiring user interaction or additional privileges, resulting in a denial of service condition.
CVE-2026-59647 is a medium severity vulnerability in Bouncy Castle for Java where the CRMF/CMP password-MAC implementation honors an unbounded iteration count. This affects versions before 1.85, and versions from 2.73.0 up to but not including 2.73.12. The issue relates to allocation of resources without limits or throttling, potentially leading to resource exhaustion.
CVE-2026-59648 is a medium severity vulnerability in Bouncy Castle for Java (BC-JAVA) affecting versions before 1.85 and certain LTS and FIPS versions. The issue involves the OpenPGP Argon2 S2K implementation honoring attacker-chosen memory and iteration parameters without limits or throttling, which can lead to resource exhaustion. No official patch or remediation level has been confirmed yet.
CVE-2026-15055 is a vulnerability in Bouncy Castle for Java (BC-JAVA) affecting versions prior to 1.85 and certain LTS and FIPS releases before specified fixed versions. The issue involves PKCS#8 / PBES2 decryptors honoring an unbounded key derivation function (KDF) cost from input, leading to allocation of resources without limits or throttling. This can potentially cause resource exhaustion.
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.
Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.
String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.
The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.
This issue affects guardian: from 2.0.0 before 2.4.1.
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.
Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.
String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.
This issue affects guardian: from 0.1.0 before 2.4.1.
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error.
CVE-2026-12733 is a high-severity vulnerability in IBM DataPower Gateway 10.6.1 where improper resource limitation can allow a remote attacker to cause a denial of service. The issue relates to allocation of resources without limits or throttling, potentially exhausting system resources and impacting availability.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-16308 is a high-severity vulnerability in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2. It involves unbounded accumulation of multipart MIME part-header bytes in the Quarkus REST component, which could allow a remote attacker to cause a denial of service (DoS). No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-18362 affects the IRIS web application version 2.4.26 and possibly other versions. The vulnerability involves the lack of protection against brute-force attacks on user authentication, categorized under CWE-770 for allocation of resources without limits or throttling. This can allow an attacker to attempt numerous authentication attempts without restriction. The CVSS score is 5.9, indicating a medium severity level.
CVE-2026-16971 is a medium severity vulnerability in the dfir-iris iris-web application version 2.4.26. The vulnerability involves insufficient protection of the multi-factor authentication (MFA) validation process against brute-force attacks, classified under CWE-770 for allocation of resources without limits or throttling. This flaw could allow an attacker to attempt numerous MFA validation requests without effective rate limiting. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.