OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.
CoreDNS versions prior to 1.14.3 contain a vulnerability in the DNS-over-HTTPS (DoH) GET path where oversized dns= query parameters are processed without size validation. This leads to excessive CPU and memory usage, causing a denial of service. The issue is fixed in version 1.14.3.
CVE-2026-43870 is a high-severity vulnerability in Apache Thrift before version 0.23.0 involving multiple security weaknesses: origin validation errors (CWE-346), path traversal (CWE-22), HTTP request/response splitting (CWE-113), and uncontrolled resource consumption (CWE-400). These issues can lead to limited confidentiality, integrity, and availability impacts. The Apache Software Foundation recommends upgrading to version 0.23.0 to address these vulnerabilities.
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion.
Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives.
Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.
More precisely, an application can be vulnerable when all the following are true:
* the application is using Spring MVC or Spring WebFlux
* the application is serving static resources from the file system
* the application is running on a Windows platform
When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.
CVE-2026-22740 is a medium severity vulnerability in VMware Spring Framework affecting certain versions. It involves uncontrolled resource consumption due to temporary files created by WebFlux server applications processing multipart requests. These temp files, created for parts larger than 10 KB, may not be deleted after request completion, potentially allowing attackers to exhaust disk space. The vulnerability affects specific versions including 5.3.0, 6.1.0, 6.2.0, and 7.0.0. No official patch or remediation guidance is currently available.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.29. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:10080
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.
Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Marked versions 18.0.0 and 18.0.1 contain a critical denial of service vulnerability caused by an infinite recursion loop triggered by a specific 3-byte input sequence (tab, vertical tab, newline). This leads to unbounded memory allocation and crashes the host Node.js application due to out-of-memory conditions. The vulnerability is fixed in version 18.0.2.
basic-ftp versions prior to 5.3.0 contain a vulnerability where processing directory listings from a remote FTP server can lead to unbounded memory growth. A malicious or compromised FTP server can send an extremely large or never-ending directory listing response to the Client.list() method, causing the client to consume excessive memory and potentially crash or become unstable. This denial of service vulnerability is fixed in version 5.3.0.
A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service.
CVE-2026-6022 is a high-severity vulnerability in Progress Software's Telerik UI for ASP. NET AJAX prior to version 2026.1.421. The RadAsyncUpload component improperly enforces file upload size limits during chunk reassembly, allowing attackers to upload files exceeding the configured maximum size. This uncontrolled resource consumption can lead to disk space exhaustion on the affected system. There is no official patch or remediation level currently confirmed. No known exploits are reported in the wild. The vulnerability impacts availability but does not affect confidentiality or integrity.
CVE-2026-41146 is a high-severity vulnerability in facil.io, a C micro-framework for web applications. The issue involves uncontrolled resource consumption due to an infinite loop in the JSON parser function `fio_json_parse` when processing nested JSON values starting with the character 'i' or 'I'. This causes the process to consume 100% CPU on one core without returning a parse error. The vulnerability also affects the iodine project, which uses the same parser code. The issue is fixed in commit 5128747363055201d3ecf0e29bf0a961703c9fa0. No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
CVE-2026-41135 is a memory leak vulnerability in free5GC's Policy Control Function (PCF) affecting versions prior to 1.4.3. An unauthenticated attacker with network access to the PCF SBI interface can cause uncontrolled memory growth by repeatedly sending HTTP requests to the OAM endpoint. This occurs because a new CORS middleware is registered on every incoming request, causing the Gin router's handler chain to grow indefinitely. The resulting memory exhaustion leads to denial of service, preventing user equipment from obtaining necessary policies and blocking 5G session establishment. Version 1.4.3 includes a patch to fix this issue.
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
SignalK Server versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack. The vulnerability arises from the WebSocket subscription handling logic where unescaped regex metacharacters in the 'context' parameter can trigger catastrophic backtracking in the Node.js event loop. This causes the server CPU to spike to 100%, resulting in a complete denial of service. The issue is fixed in version 2.25.0.
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver.will be killed by the systemThis issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.3.X
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.