IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability where a remote authenticated attacker can cause a denial of service by triggering resource allocation without limits or throttling. This can exhaust system resources, leading to service disruption.
CVE-2026-118260 is a high-severity vulnerability in the labstack Echo Go web framework versions 4.0.0 through 4.16.0. The opt-in BodyDump middleware reads entire request and response bodies into memory without limits, allowing unauthenticated clients to cause uncontrolled memory consumption by sending large requests or triggering large responses. This can exhaust process memory and potentially disrupt service. The issue is fixed in version 4.16.1.
MIME::Parser versions prior to 5.521 for Perl have an insecure default configuration that does not limit the number of message parts processed, potentially leading to memory exhaustion. The default max_parts option was set to -1, disabling any limit and allowing a parser to build an entity for every message part regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64 to mitigate this issue.
HTTP::Body versions before 1.24_01 for Perl contain a vulnerability that allows memory exhaustion via unbounded buffering of chunked HTTP request bodies. The parser holds each chunk in memory until the entire body is received, and malformed chunk-size lines cause the buffer to grow indefinitely. This can be exploited remotely to exhaust application memory.
CVE-2026-116134 is a vulnerability in HTTP::Body for Perl versions before 1.23_01. It allows a remote attacker to cause memory exhaustion by sending a multipart request with an unbounded part header block. The multipart parser does not limit the size or number of lines in the header block, leading to excessive memory consumption.
CVE-2026-116131 is a vulnerability in HTTP::Body for Perl versions before 1.23_01 that allows resource exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser consumes excessive memory by splitting the entire body at once, and the multipart parser creates temporary files for each part with a filename without limits. This can lead to memory exhaustion or creation of thousands of temporary files from a single request.
CVE-2026-111108 is a critical vulnerability in Apache Kafka affecting versions from 3.3.0 through 4.3.1. The flaw involves the allocation of resources without proper limits or throttling during request parsing, allowing an attacker to cause excessive heap memory allocation by declaring large array lengths in requests. This can lead to broker crashes due to OutOfMemoryError, even before authorization checks occur. The issue is mitigated in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0 by capping array pre-allocation and rejecting overly large array lengths.
CVE-2026-111073 is a vulnerability in Apache Kafka's broker-side PushTelemetry API where the system validates only the compressed payload size before decompression, allowing a small compressed payload to decompress into a very large heap allocation. This can lead to excessive memory consumption and potential broker crashes due to OutOfMemoryError. The vulnerability affects Apache Kafka versions from 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and version 4.3.0. Fixed versions include Apache Kafka 4.2.2, 4.3.1, and 4.4.0, which enforce a maximum decompressed size limit equal to telemetry.max.bytes. The vulnerability requires an authenticated client but is not restricted by ACLs.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.
This issue affects bandit: from 0.3.1 before 1.14.1.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a vulnerability involving allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a medium severity rating and a CVSS score of 5.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively for the affected release lines.
CVE-2026-116775 is a low-severity vulnerability in the Eugeny russh library affecting versions from 0.2.0 up to but not including 0.2.5. The issue arises from the PageantStream::new function trusting a peer-controlled length prefix without enforcing the fixed transport capacity limit, which can lead to excessive memory allocation or retention of partial frames. This can cause client memory exhaustion when bridging an SSH forwarded-agent channel to the raw stream. The vulnerability is fixed in version 0.2.5.
CVE-2026-116773 is a resource exhaustion vulnerability in the russh Rust SSH client and server library prior to version 0.65.0. The client improperly handles repeated private EXT_INFO messages (msg::EXT_INFO = 7) before authentication by appending extension names to a vector without limits or deduplication, leading to unbounded memory growth. This can cause progressive memory exhaustion on the client side. The issue is fixed in version 0.65.0.
CVE-2026-116696 is a resource allocation vulnerability in the russh Rust SSH client and server library prior to version 0.65.0. The issue arises from the handling of repeated SSH_AGENT_CONSTRAIN_CONFIRM records when adding keys, which causes unbounded memory growth due to constraints being appended without limits. This can lead to a denial of service by exhausting memory over the lifetime of the process. The vulnerability is fixed in russh version 0.65.0.
CVE-2026-116694 is a resource allocation vulnerability in the OpenTelemetry Python SDK prior to version 1.45.0. The JaegerPropagator.extract() function processes inbound baggage values without limits on entry count or size, which can lead to excessive CPU usage and heap allocations. This may contribute to denial of service if untrusted input is not constrained by transport-level limits. The issue is fixed in version 1.45.0.
CVE-2026-54462 is a resource exhaustion vulnerability in the Knative pkg webhook admissionHandler prior to version 0.0.0-20260531000007-52dbd5ece63f. The vulnerability arises because the admissionHandler decodes attacker-supplied AdmissionReview requests without enforcing a maximum body size limit. This allows a pod-network client to send an oversized POST request that causes the webhook server to retain amplified copies of the request in memory, potentially exhausting memory and causing the controller pod to be OOM-killed. This affects all downstream consumers using the shared webhook server, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. The issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
CVE-2026-116587 is a vulnerability in go-jose prior to version 4.1.6 where attacker-controlled RSA parameters in JSON Web Keys (JWKs) are parsed without proper size and consistency checks. On Go 1.24 and later, this can cause the RSA key validation to consume cubic CPU time, leading to a remote denial of service (DoS). The issue is fixed in go-jose version 4.1.6.
A resource exhaustion vulnerability exists in seroval versions from 1.4.1 up to but not including 1.6.8. The fromJSON and fromCrossJSON functions do not enforce that an array node's element list is an actual array, allowing an attacker to supply a crafted payload that controls memory allocation and processing iterations independently of payload size. This can lead to denial of service by exhausting process memory or blocking the thread. The issue is a residual bypass of a previous fix and is resolved in version 1.6.8.
A vulnerability in crossbario autobahn-python versions 26.7.1 through 26.10.0 allows an unauthenticated WebSocket client to cause a memory exhaustion denial of service. The issue arises because the Brotli decompressor is called without an output limit, allowing a small, highly compressed frame to expand to hundreds of MiB before the server enforces the maximum message payload size. This flaw affects servers that enable the permessage-brotli feature via the compress extra. The vulnerability is fixed in version 26.10.1.
CVE-2026-116577 is a vulnerability in the Tornado Python web framework prior to version 6.6. The HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. This allows an unauthenticated client to submit specially crafted headers that block other connections by exhausting CPU resources. The issue affects availability only and is fixed in Tornado version 6.6.