CVE-2026-93926 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving missing release of memory and resources after their effective lifetime in the THeaderTransport component. This can lead to resource exhaustion or memory leaks. The issue is fixed in Apache Thrift version 0.25.0.
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might lead to denial of service.
CVE-2026-102716 is a high-severity memory leak vulnerability in Eclipse ThreadX NetX Duo up to version 6.5.2.202603. The RTSP server improperly handles malformed Session headers by returning a parser error but failing to release the allocated response packet. This allows an unauthenticated client to exhaust the server's packet pool with relatively few requests, causing the RTSP server and potentially the entire network stack to stop functioning until the device is restarted.
CVE-2026-102762 is a high-severity vulnerability in the Eclipse Foundation's NetX Duo MQTT client. It causes a memory leak by failing to release packets carrying malformed PUBLISH messages. Each malformed message consumes resources from the network driver's receive pool without returning them, potentially exhausting the pool. This exhaustion halts all inbound network traffic on the affected device until it is rebooted.
CVE-2026-95395 is a medium severity vulnerability in Wireshark affecting versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.8. It involves a memory leak in the IEEE C37.118 Synchrophasor protocol dissector that can lead to denial of service. The flaw is due to missing release of memory after its effective lifetime. No known exploits are reported in the wild. No official patch information is provided in the input data.
CVE-2026-102006 is a vulnerability in Wind River VxWorks 7 prior to version 26.09 where certain system call arguments cause the process management subsystem to fail to release allocated kernel memory when terminating an application. This results in a memory leak affecting system availability. The issue is fixed in version 26.09.
CVE-2026-102005 is a medium severity memory leak vulnerability in Wind River VxWorks 7 versions 24.03 through 26.03. The issue occurs under specific, non-default configuration states when processing certain service routines, causing the system to terminate operations without releasing allocated memory pools. This vulnerability was fixed in version 26.09.
CVE-2026-87078 is a critical memory leak vulnerability in Net::IDN::Punycode Perl module versions from 2.302 up to but not including 2.590. The issue occurs in the XS backend during the decode_punycode function, where output buffers are allocated before input validation and only released on successful decoding. Invalid labels cause the buffers to remain allocated, leading to unbounded memory growth proportional to twice the label length per rejected call. This affects only the XS backend implementation.
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
CVE-2026-92230 is a high-severity vulnerability in Apache Karaf where static ThreadLocal fields cache XML parser/transformer factories on long-lived container threads. This causes memory from successive bundle ClassLoaders to be retained and unreachable for garbage collection after bundle lifecycle operations, leading to unbounded Metaspace growth and potential denial of service.
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and processRpcSubOpt in packages/floodsub/src/floodsub.ts synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.
CVE-2026-81563 is a high-severity memory management vulnerability in ISC BIND 9. It occurs when a BIND resolver processes an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records, leading to failure in releasing internal resources. This can cause resource exhaustion and prevent new recursive DNS lookups. The vulnerability affects multiple BIND 9 versions from 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and several S1 variants. No patch or remediation details are provided, and no known exploits are reported in the wild.
CVE-2026-69781 is a vulnerability in the Windows DHCP Client of Microsoft Windows 11 Version 24H2 that involves missing release of memory after its effective lifetime. This flaw can be exploited by an unauthorized attacker on an adjacent network to cause a denial of service condition. The issue has been officially fixed in specific Windows 11 builds.
CVE-2026-69809 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 related to a missing release of memory after its effective lifetime in Active Directory Domain Services. This flaw allows an unauthorized attacker to cause a denial of service over a network by exhausting system memory resources. The issue affects multiple Windows 11 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-69497 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions where the DHCP Server component fails to release memory after its effective lifetime. This flaw allows an authorized attacker to cause a denial of service (DoS) over the network by exhausting system memory. The issue affects multiple Windows versions and has been assigned a medium severity with a CVSS score of 6.5. Microsoft has released official fixes for all affected versions.
CVE-2026-69405 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions where the DHCP Server component fails to release memory after its effective lifetime. This flaw allows an authorized attacker to cause a denial of service on an adjacent network by exhausting memory resources. The issue affects multiple Windows versions and has been assigned a medium severity rating with a CVSS score of 5.7. Microsoft has released official fixes for all affected versions.